A MEASUREMENT, NOT A GUESS

How ECHScan works

What ECH protects

Encrypted Client Hello encrypts the inner TLS ClientHello, including the hostname normally exposed through SNI. It complements HTTPS. Your destination IP and traffic patterns can still reveal information; ECH is not anonymity.

From DNS to a real handshake

We query HTTPS service bindings using Cloudflare’s 1.1.1.1 recursive resolver over TCP. We follow bounded CNAME and HTTPS aliases, process priorities, mandatory parameters and TCP ALPN, and validate addresses before connecting to pinned public IPs on port 443.

The scanner offers the published ECHConfigList using Go’s standard TLS implementation. Certificate and hostname verification remain enabled. A green endpoint requires a completed TLS handshake and explicit ECH acceptance. An authenticated rejection can supply new keys; we allow one retry on that same endpoint.

Understand your result

No published configuration means this resolver did not return ECH configuration. A rejection means the server did not accept the offered ECH keys. Check key rotation and DNS propagation. Certificate errors require a valid certificate chain for the inner name, or the outer public name during rejection. Timeouts are network errors and do not prove ECH is disabled.

Measurement limits

We test at most four service records and six endpoints, in priority order, with IPv4 and IPv6 interleaved. Retries can add one connection per endpoint. DNS is limited to 24 queries and the entire scan to 22 seconds. Lower priorities, other regions, resolvers and untested addresses may differ. Missing scanner connectivity is marked not checked. DNSSEC is not independently validated. Generic SVCB records are not substituted for HTTPS records for an HTTPS origin.

This is a server-side TCP/TLS 1.3 measurement. It does not test your browser, QUIC, HTTP/3, page content or redirects. A mixed result is never an overall green result. Reports expire after one hour; DNS and results are cached for five minutes.

Technical references: RFC 9460 and Go crypto/tls.