--- title: "ECH Is Done, But Can We Make It Work?" url: https://daily.dev/posts/ech-is-done-but-can-we-make-it-work--hltj5jdpk source_url: https://www.feistyduck.com/newsletter/issue_136_ech_is_done_but_can_we_make_it_work type: article source: "Feisty Duck" published: 2026-04-30T11:32:36.789Z updated: 2026-04-30T11:39:19.216Z tags: ["privacy", "cryptography", "dns"] reading_time: 6 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ECH Is Done, But Can We Make It Work? **[Feisty Duck](https://daily.dev/sources/feistyduck)** · 6 min read · 0 upvotes · 0 comments ## Summary Encrypted Client Hello (ECH) has been finalized as RFC 9849 after eight years of development, with major browsers already supporting it. ECH encrypts the TLS handshake to prevent network observers from identifying destination domains. Server-side adoption is still early — Cloudflare supports it, OpenSSL 4.0 just added support, and Nginx 1.30.0 includes it. Key challenges remain: governments and enterprises can still block ECH by detecting the static outer domain name used during handshakes, and obtaining ECH bootstrapping configuration via DNS is difficult in censored environments where plaintext DNS can be forged and DNS-over-HTTPS is blocked. The path to effective privacy requires both technical fixes to the stale-config problem and sufficient ecosystem adoption to achieve safety in numbers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Encrypted Client Hello \(ECH\) is now supported on Vercel CDN](https://daily.dev/posts/encrypted-client-hello-ech-is-now-supported-on-vercel-cdn-ugddpiunl) · Vercel · 0 upvotes · 0 comments - [RFC 9849: TLS Encrypted Client Hello](https://daily.dev/posts/rfc-9849-tls-encrypted-client-hello-exjfuobix) · Hacker News · 0 upvotes · 0 comments - [I thought encrypted DNS protected my privacy, until I saw what my ISP could still see](https://daily.dev/posts/i-thought-encrypted-dns-protected-my-privacy-until-i-saw-what-my-isp-could-still-see-4hfftneak) · XDA Developers · 0 upvotes · 0 comments - [OpenSSL 4.0 Alpha 1 Released With Encrypted Client Hello "ECH" & Other Features](https://daily.dev/posts/openssl-4-0-alpha-1-released-with-encrypted-client-hello-ech-other-features-mequ8p2e0) · Phoronix · 0 upvotes · 0 comments --- Tags: [#privacy](https://daily.dev/tags/privacy), [#cryptography](https://daily.dev/tags/cryptography), [#dns](https://daily.dev/tags/dns) [View this post on daily.dev](https://daily.dev/posts/ech-is-done-but-can-we-make-it-work--hltj5jdpk)