> And if I'm not mistaken, even on HTTPS sites, the domain is visible in the request in plaintext too. I originally misread this sentence. Yes, HTTPS requests

> And if I'm not mistaken, even on HTTPS sites, the domain is visible in the request in plaintext too. I originally misread this sentence. Yes, HTTPS requests expose the domain/subdomain name in plaintext to support Server Name Indication, which allows a server to host multiple HTTPS sites.[1] The domain/subdomain name can be concealed from the ISP with Encrypted SNI,[2] which Cloudflare's 1.1.1.1 DNS resolver supports. Firefox used to support ESNI as an about:config option, but in version 85, Firefox replaced it with support for an improved mechanism called Encrypted Client Hello.[3][4] ECH is not widely used yet, though Cloudflare is testing it on some of its servers.[5] With DNS over HTTPS/TLS and ECH, the entire process of connecting to an HTTPS site can be done without leaking the domain/subdomain name to the ISP. The only remaining parts exposed in plaintext are the remote IP address and port. [1] https://https.cio.gov/faq/#why-are-domain-names-unencrypted-over-https-today https://https.cio.gov/faq/#why-are-domain-names-unencrypted-... [2] https://www.cloudflare.com/learning/ssl/what-is-encrypted-sni/ https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn... [3] https://blog.mozilla.org/security/2021/01/07/encrypted-client-hello-the-future-of-esni-in-firefox/ https://blog.mozilla.org/security/2021/01/07/encrypted-clien... [4] https://blog.cloudflare.com/encrypted-client-hello/ https://blog.cloudflare.com/encrypted-client-hello/ [5] https://blog.cloudflare.com/handshake-encryption-endgame-an-ech-update/ https://blog.cloudflare.com/handshake-encryption-endgame-an-...