# Encrypted Client Hello Is Coming: A View from Passive Measurements
## 4 Results
### Https DNS Traffic
In some cases, as with Microsoft AS, no responses are observed at all despite millions of daily queries. In summary, clients support HTTPS DNS issue queries regardless of the target; however, only Cloudflare offers partial support, while other players answer those queries in only a minimal (or null) fraction. In Figure 3, we further analyze HTTPS DNS responses in DNS-Outgoing in terms of the content they carry. Recall that such responses may contain a variety of information, including (i) the server IPv4 or IPv6 addresses (similar to A and AAAA responses), (ii) the Application Layer Protocol Negotiation (ALPN, i.e., the Layer 7 protocols supported by the server), and (iii) the public key to be used by the client to produce an ECH. Figure 3 shows the fraction of responses containing such information, separately for the top 5 ASes per response rate. We find that in most cases, the responses do not contain the server's IP address(es)--information essential for the client for establishing any connection to the required server. Thus, the clients need to rely on additional A or AAAA queries to obtain this information. An extreme case is that of Apple, whose responses are always empty, i.e., the DNS server returns a non-error HTTPS DNS response with no data. Only Fastly DNS servers always return a complete response, containing IP addresses and ALPN. Facebook \begin{table}
\begin{tabular}{l c c c c} \hline \hline  & \multicolumn{2}{c}{**DNS-Outgoing**} & \multicolumn{2}{c}{**DNS-Incoming**} \\ \cline{2-5}  & **Query** & **Response** & **Query** & **Response** \\ \hline A & 38.67\% & 48.28\% & 53.34\% & 64.04\% \\ AAAA & 19.18\% & 5.69\% & 17.68\% & 0.1\% \\ HTTPS & 7.89\% & 0.89\% & 5.48\% & 0\% \\ NS & 29.7\% & 2.76\% & 3.03\% & 0.7\% \\ Other & 4.56\% & 42.38\% & 20.47\% & 35.16\% \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Distribution of DNS query types and responses. and Google responses, conversely, contain (almost) uniquely the ALPN, indicating that servers can be reached using the HTTP/3 and QUIC protocols. Focusing on the presence of the ECH public key, among the five ASes in the Figure 3, only Cloudflare includes it in the 16% of its responses. Over the entire DNS-Outgoing dataset, we find 8 ASes returning at least one response with a valid key. However, they are all related to Cloudflare domains, as we determined by decoding the base64-encoded key parameter (these keys are all associated with the ECH public name _cloudflare-ech.com_). This suggests that the rare occurrences of ECH keys in responses from non-Cloudflare ASes are likely the result of domains that are part of the Cloudflare infrastructure, but registered under different DNS zones. In summary, even when a client obtains a valid response to an HTTPS query, in most cases, it is incomplete, lacking the server IP address(es). This suggests that HTTPS DNS deployment is at an early stage, and any client willing to use it still needs to issue A and AAAA queries as well. We now analyze the frequency of DNS HTTPS queries across resolvers from different ISPs, thus considering the DNS-incoming dataset. Figure 4 presents the distribution of DNS query types among the top 10 ISPs in terms of packet volume. The predominant ISPs are Italian, which aligns with the fact that our organization is an Italian university serving students and staff primarily from Italy. An exception is _Free_, a French telecommunications provider affiliated with Iliad, which operates in Italy through its subsidiary Iliad Italia. Consequently, Iliad's DNS queries are resolved by Free's DNS infrastructure in Italy. Other exceptions are 1&1, a German ISP, and Renater, which provides internet access to French universities. Overall, all ISPs but 1&1 issue HTTPS DNS queries, meaning that the ISP  
Figure 3: Breakdown of the HTTPS DNS response content (DNS-Outgoing dataset). Figure 2: Response rate for the HTTPS DNS queries (DNS-Outgoing dataset).