# What Is ESNI (Encrypted Server Name Indication)?

> ESNI (Encrypted SNI) is an abandoned TLS 1.3 draft that encrypted only the SNI field with a key published in DNS; it has been superseded by ECH.

Source: https://ssl.sh/glossary/esni/
Last updated: 2026-11-10

ESNI was an IETF draft design that encrypted the [SNI](https://ssl.sh/glossary/sni/) extension of a TLS 1.3 ClientHello with a public key the server published in a DNS TXT record under `_esni.<domain>`. Cloudflare and Firefox experimented with it around 2018, but it never became an RFC. The TLS working group redesigned it as [ECH](https://ssl.sh/glossary/ech/), which encrypts the entire ClientHello and was published as RFC 9849 in March 2026.

## Why it matters
Today ESNI matters mainly as history and as a source of confusion. Encrypting only the SNI turned out to be too narrow: other ClientHello extensions, such as the ALPN list, could still leak information about the destination, and a client holding a stale key had no robust way to recover. ECH addresses both with an inner/outer ClientHello structure and a retry mechanism. Firefox removed ESNI in favour of ECH, and servers no longer offer it, so documentation or software that still talks about enabling ESNI is describing an obsolete draft.

## Example
The two designs publish their keys differently:

```text
; ESNI (obsolete draft): key in a TXT record
_esni.example.com.  IN TXT    "<base64 ESNIKeys>"

; ECH (RFC 9849): config in an HTTPS record
example.com.        IN HTTPS  1 . alpn="h2" ech="<base64 ECHConfigList>"
```

## Common misconceptions
- **ESNI and ECH are interchangeable names.** ESNI encrypted one extension; ECH encrypts the full inner ClientHello and is the only standardized design.
- **Turning on ESNI in a browser still adds privacy.** Mainstream browsers no longer implement ESNI and servers do not accept it; the setting to look for is ECH.
- **ESNI was needed because TLS 1.3 sends the certificate in plaintext.** [TLS 1.3](https://ssl.sh/glossary/tls-1-3/) already encrypts the server certificate. The remaining plaintext hostname was the SNI itself, which is why TLS 1.3 alone did not hide the destination.

## Related terms

- [ECH](https://ssl.sh/zh/glossary/ech/): ECH 是 TLS 1.3 的扩展，用发布在 DNS 中的公钥加密 ClientHello 的敏感部分（包括 SNI），链路上只能看到前端服务器的公共名称。
- [SNI](https://ssl.sh/zh/glossary/sni/): SNI 是 TLS 的一个扩展，客户端在 ClientHello 中写明要访问的域名，使同一个 IP 能为多个 HTTPS 站点分别返回各自的证书。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。
- [TLS 握手](https://ssl.sh/zh/glossary/tls-handshake/): TLS 握手是 TLS 连接开始时的一组消息交换，客户端与服务器在其中协商协议版本和密码套件、验证服务器身份并派生会话密钥。
- [DNSSEC](https://ssl.sh/zh/glossary/dnssec/): DNSSEC 是一组 DNS 扩展，让解析器能沿着从根区开始的签名链，验证 DNS 应答确实来自权威方且未被篡改。