Encrypt it or lose it: how encrypted SNI works

This post introduces and explains Encrypted SNI (ESNI), a new privacy-enhancing feature for TLS 1.3. It details how ESNI works by encrypting the SNI extension using public-key cryptography published via DNS, preventing on-path observers from identifying visited websites. The post also highlights the importance of encrypted DNS (DoT/DoH) and DNSSEC for ESNI's effectiveness and discusses the ongoing challenge of IP address-based tracking.