Happy Eyeballs
Encrypted Client Hello (ECH) Test

Encrypted Client Hello (ECH, RFC 9849) allows a TLS client to encrypt the inner ClientHello, hiding the Server Name Indication (SNI) from network observers. A server advertises its ECH public key via an echconfig= parameter in an HTTPS DNS record.

We test several scenarios: no HTTPS record (ECH unavailable), an HTTPS record with a valid echconfig= (browser should use ECH) — both dual-stack and IPv6-only — and HTTPS records with stale/wrong keys (browser must perform an ECH retry using retry_configs from the server, or hard-fail when none are delivered). All scenarios report reachability and protocol; ECH usage is inferred from DNS query logs (whether the browser fetched the HTTPS record before connecting).