{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T21:22:49Z","timestamp":1782940969679,"version":"3.54.5"},"reference-count":21,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2025,8,8]],"date-time":"2025-08-08T00:00:00Z","timestamp":1754611200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Italian Ministry of University and Research","award":["20228FT78M"],"award-info":[{"award-number":["20228FT78M"]}]},{"name":"Italian Ministry of University and Research","award":["2022M2Z728"],"award-info":[{"award-number":["2022M2Z728"]}]},{"name":"Italian Ministry of University and Research","award":["D53D23001340006"],"award-info":[{"award-number":["D53D23001340006"]}]},{"name":"Next Generation EU","award":["20228FT78M"],"award-info":[{"award-number":["20228FT78M"]}]},{"name":"Next Generation EU","award":["2022M2Z728"],"award-info":[{"award-number":["2022M2Z728"]}]},{"name":"Next Generation EU","award":["D53D23001340006"],"award-info":[{"award-number":["D53D23001340006"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Network"],"abstract":"<jats:p>The Encrypted Client Hello (ECH) extension to Transport Layer Security (TLS) and the new type of Domain Name System (DNS) records called HTTPS represent the latest efforts to improve user privacy by encrypting the server\u2019s domain name during the TLS handshake. While prior studies have assessed ECH adoption from the server perspective, little is known about its usage in the wild from a passive network standpoint. In this paper, we present the first passive analysis of ECH and HTTPS DNS adoption using a month-long dataset collected from an operational network. We find that HTTPS DNS queries already make up approximately 8% of total DNS traffic, although responses to those queries are often incomplete, leading to increased query volume. Furthermore, 59% of QUIC flows include ECH, although only a negligible fraction is directed to servers supporting it. The remaining ECH flows are composed of GREASE values, intended to prevent protocol ossification. Our findings provide new insights into the current state and challenges in deploying privacy-enhancing protocols at scale.<\/jats:p>","DOI":"10.3390\/network5030029","type":"journal-article","created":{"date-parts":[[2025,8,8]],"date-time":"2025-08-08T08:09:35Z","timestamp":1754640575000},"page":"29","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["Encrypted Client Hello Is Coming: A View from Passive Measurements"],"prefix":"10.3390","volume":"5","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-0525-1148","authenticated-orcid":false,"given":"Gabriele","family":"Merlach","sequence":"first","affiliation":[{"name":"Department of Engineering and Architecture, University of Trieste, 34127 Trieste, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4258-4679","authenticated-orcid":false,"given":"Martino","family":"Trevisan","sequence":"additional","affiliation":[{"name":"Department of Engineering and Architecture, University of Trieste, 34127 Trieste, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6987-2064","authenticated-orcid":false,"given":"Danilo","family":"Giordano","sequence":"additional","affiliation":[{"name":"Department of Control and Computer Engineering, Politecnico di Torino, Corso Duca degli Abruzzi, 10129 Torino, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,8,8]]},"reference":[{"key":"ref_1","unstructured":"Farrell, S., and Tschofenig, H. (2025, August 04). Pervasive Monitoring Is an Attack. RFC 7258. Available online: https:\/\/www.rfc-editor.org\/rfc\/rfc7258.html."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Naylor, D., Finamore, A., Leontiadis, I., Grunenberger, Y., Mellia, M., Munaf\u00f2, M., Papagiannaki, K., and Steenkiste, P. (2014, January 2\u20135). The cost of the\u201c s\u201d in https. Proceedings of the 10th ACM International on Conference on emerging Networking Experiments and Technologies, Sydney, Australia.","DOI":"10.1145\/2674005.2674991"},{"key":"ref_3","unstructured":"Iyengar, J., and Thomson, M. (2025, August 04). QUIC: A UDP-Based Multiplexed and Secure Transport. RFC 9000. Available online: https:\/\/www.rfc-editor.org\/info\/rfc9000."},{"key":"ref_4","unstructured":"Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D., and Hoffman, P.E. (2025, August 04). Specification for DNS over Transport Layer Security (TLS). RFC 7858. Available online: https:\/\/www.rfc-editor.org\/info\/rfc7858."},{"key":"ref_5","unstructured":"Hoffman, P.E., and McManus, P. (2025, August 04). DNS Queries over HTTPS (DoH). RFC 8484. Available online: https:\/\/www.rfc-editor.org\/info\/rfc8484."},{"key":"ref_6","unstructured":"Casanova, L.F.G., and Lin, P.C. (2021, January 14\u201317). Generalized classification of DNS over HTTPS traffic with deep learning. Proceedings of the 2021 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), Tokyo, Japan."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Vekshin, D., Hynek, K., and Cejka, T. (2020, January 25\u201328). Doh insight: Detecting dns over https by machine learning. Proceedings of the 15th International Conference on Availability, Reliability and Security, Virtual.","DOI":"10.1145\/3407023.3409192"},{"key":"ref_8","unstructured":"Rescorla, E., Oku, K., Sullivan, N., and Wood, C.A. (2025, August 04). TLS Encrypted Client Hello. Internet-Draft draft-ietf-tls-esni-24, Internet Engineering Task Force. Work in Progress. Available online: https:\/\/datatracker.ietf.org\/doc\/draft-ietf-tls-esni\/24\/."},{"key":"ref_9","unstructured":"Schwartz, B.M., Bishop, M., and Nygren, E. (2025, August 04). Service Binding and Parameter Specification via the DNS (SVCB and HTTPS Resource Records). RFC 9460. Available online: https:\/\/www.rfc-editor.org\/info\/rfc9460."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"16","DOI":"10.1145\/3411740.3411743","article-title":"Does domain name encryption increase users\u2019 privacy?","volume":"50","author":"Trevisan","year":"2020","journal-title":"ACM SIGCOMM Comput. Commun. Rev."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1145\/3570726","article-title":"Attacking DoH and ECH: Does Server Name Encryption Protect Users\u2019 Privacy?","volume":"23","author":"Trevisan","year":"2023","journal-title":"ACM Trans. Internet Technol."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"77883","DOI":"10.1109\/ACCESS.2022.3191431","article-title":"Is encrypted clienthello a challenge for traffic classification?","volume":"10","author":"Shamsimukhametov","year":"2022","journal-title":"IEEE Access"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Bhargavan, K., Cheval, V., and Wood, C. (2022, January 7\u201311). A symbolic analysis of privacy for tls 1.3 with encrypted client hello. Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, Los Angeles, CA, USA.","DOI":"10.1145\/3548606.3559360"},{"key":"ref_14","first-page":"64","article-title":"Encrypted Client Hello (ECH) in Censorship Circumvention","volume":"2","author":"Niere","year":"2025","journal-title":"Free. Open Commun. Internet"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Tsiatsikas, Z., Karopoulos, G., and Kambourakis, G. (2022). Measuring the adoption of TLS encrypted client hello extension and its forebear in the wild. European Symposium on Research in Computer Security, Springer.","DOI":"10.1007\/978-3-031-25460-4_40"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Zirngibl, J., Sattler, P., and Carle, G. (2023, January 3\u20137). A first look at SVCB and HTTPS DNS resource records in the wild. Proceedings of the 2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Delft, The Netherlands.","DOI":"10.1109\/EuroSPW59978.2023.00058"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Dong, H., Zhang, Y., Lee, H., Huque, S., and Sun, Y. (2024, January 4\u20136). Exploring the Ecosystem of DNS HTTPS Resource Records: An End-to-End Perspective. Proceedings of the 2024 ACM on Internet Measurement Conference, Madrid, Spain.","DOI":"10.1145\/3646547.3688410"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"163","DOI":"10.1109\/MCOM.2017.1600756CM","article-title":"Traffic analysis with off-the-shelf hardware: Challenges and lessons learned","volume":"55","author":"Trevisan","year":"2017","journal-title":"IEEE Commun. Mag."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Trevisan, M. (2025, August 04). Dpmon: A Differentially-Private Query Engine for Passive Measurements. Preprint. Available online: https:\/\/ssrn.com\/abstract=4901748.","DOI":"10.2139\/ssrn.4901748"},{"key":"ref_20","unstructured":"Benjamin, D. (2025, August 04). Applying Generate Random Extensions And Sustain Extensibility (GREASE) to TLS Extensibility. RFC 8701. Available online: https:\/\/www.rfc-editor.org\/info\/rfc8701."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"253","DOI":"10.1016\/j.comnet.2004.03.033","article-title":"Crypto-pan: Cryptography-based prefix-preserving anonymization","volume":"46","author":"Fan","year":"2004","journal-title":"Comput. Netw."}],"container-title":["Network"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2673-8732\/5\/3\/29\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:26:07Z","timestamp":1760034367000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2673-8732\/5\/3\/29"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,8,8]]},"references-count":21,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2025,9]]}},"alternative-id":["network5030029"],"URL":"https:\/\/doi.org\/10.3390\/network5030029","relation":{},"ISSN":["2673-8732"],"issn-type":[{"value":"2673-8732","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,8,8]]}}}