Background
ECH encrypts the TLS Client Hello's server_name with a
public key the client fetches from DNS ahead of time, so an on-path observer can no longer read which
hostname a connection is for.
A probe against a domain (over TCP or QUIC) is classified as: ECH accepted — the server completed the handshake using the offered configuration; rejected — the server understood ECH but rejected the offered configuration, optionally returning fresh retry configurations; or a plain connection error — no meaningful ECH signal at all.
Project team
Jonas Mücke — TU Dresden
Contact
Questions about ECH handshakes, this tool, or anything it reports — reach out at jonas.muecke@tu-dresden.de.