Hacker News Reader

No, they only include the DNS server name in cleartext. (Unless I’m misunderstanding DoH)

The lookup is encrypted yes. Your actual subsequent request to the webserver you looked up the DNS entry for however exposes the host in clear text. This is how a lot of corporate firewalls sniff HTTPS requests for host without a root cert.

https://security.stackexchange.com/questions/86723/why-do-ht...

If you enable it in about:config, Firefox does support the Encrypted SNI proposal when used with DoH and providers that support it. It works for me on Firefox for Android.

https://blog.cloudflare.com/encrypted-sni/

Disclaimer: I work for Cloudflare, but not on this project.

ESNI is a great solution but unlike DoH it has yet to see wider adoption. I have it enabled and I have Firefox pointed to my local DoH server, the majority of the websites still reply with NXDOMAIN to the _esni query. Besides Cloudflare I've only found 1 other website that has it enabled.

Reply on news.ycombinator.com