ECH became an IETF Proposed Standard in March 2026
Retrospective: encrypted handshakes still depend on DNS and server deployment.
- Event / announcement date
- 2026-03-03
- Earliest linked source date
- 2026-03-03
- NewsTumble first published
- 2026-10-26T21:38:22Z
- NewsTumble updated
- 2026-10-26T21:38:22Z
The IETF’s publication history records March 3, 2026, as the date RFC 9849 became a Proposed Standard for Encrypted Client Hello, or ECH. [1]
TLS 1.3 can expose its initial server-name field. ECH encrypts a private inner opening message within a public outer message; a supporting server decrypts and processes the inner version. [2]
RFC 9848 delivers configuration through DNS service-binding or HTTPS records. Advertised addresses need suitable key access or authority for the public name; incompatible configurations can make connections fail. [3]
ECH alone does not provide complete anonymity. DNS resolvers still learn the hostname; visible IP addresses and traffic patterns can help observers infer a destination despite the encrypted name field. Sharing consistent server configurations can obscure which co-hosted service a user reached. [2] [3]
Useful checks include client and site support, DNS privacy and remaining exposure. These specifications describe mechanisms; this report did not test deployments. [2] [3]
The source
- IETF Datatracker: RFC publication history ↗
Source published 2026-03-03 · reviewed October 26, 2026 - RFC Editor: Encrypted Client Hello standard ↗
Undated reference · reviewed October 26, 2026 · No publication date to day precision established; RFC header states March 2026. - RFC Editor: ECH DNS bootstrap standard ↗
Undated reference · reviewed October 26, 2026 · No publication date to day precision established; RFC header states March 2026.
About this item: Retrospective report. No first-hand reporting or independent testing is claimed. Corrections policy.
