DEPLOYMENT AND VERIFICATION
How to enable and verify ECH
ECH requires coordinated DNS and TLS support. A DNS edit alone is insufficient. Start with the service that terminates public TLS for your hostname, whether that is your server, reverse proxy or CDN.
Prepare the TLS service
- Confirm that your TLS provider supports ECH for your domain and deployment mode. Follow its current configuration instructions.
- Obtain the matching public ECH configuration from that provider. Private keys belong on the TLS service, never in DNS.
- Publish or enable the provider’s HTTPS DNS records. Check aliases, service targets and every advertised address family.
Verify the deployed result
Run an ECH check and inspect each endpoint. A confirmed result requires a completed, certificate-verified handshake with ECH acceptance. Read the coverage notice: a bounded scan cannot establish worldwide support.
If one family is untested, investigate that separately. For failures, follow the report’s recommendation instead of assuming a missing DNS record is the only cause.
Keep DNS and TLS keys coordinated
Plan key rotation with the TLS provider and account for cached DNS answers. ECHScan permits one authenticated retry per endpoint. Repeated retries warrant checking propagation and deployment consistency. A successful retry still confirms ECH for that tested connection.
For configuration requirements, see RFC 9848. For specific result categories, see the troubleshooting guide.