# Encrypted Client Hello Is Coming: A View from Passive Measurements
## 4 Results
### Https DNS Traffic  
We first characterize the prevalence of HTTPS queries and responses in DNS traffic at the campus network border. In Table 1, we present a breakdown of the observed DNS packets, distinguishing between DNS-Outgoing and DNS-Incoming datasets. Starting with DNS-Outgoing, we observe that HTTPS DNS queries already represent a non-negligible proportion of 7.89% of total DNS traffic. Interestingly, AAAA requests represent 19.18% of the total, although internal clients are not assigned an IPv6 address (Likely, browsers issue AAAA queries even if they run on an IPv4-only host). Regarding responses, 48% are of type A, confirming that IPv4 is still prevalent. HTTPS-type responses account for only 0.89% of the total, as the vast majority of HTTPS queries do not receive any response--only 3.8% of HTTPS queries are answered. This is particularly interesting, as, at the current state, although HTTPS queries represent a sizable fraction, they typically remain unanswered as DNS servers do not yet support them, thus generating a useless load on clients and local/authoritative resolvers. Passing to the DNS-Incoming dataset, overall, we again observe a large prevalence of type A queries (53.34%) and a smaller fraction of AAAA (17.68%). We find 5.48% of queries for HTTPS records, which, despite being lower than in DNS-Outgoing, represents a sizable fraction. Recall that DNS-Incoming includes traffic destined to the campus resolver by all external nodes--mostly local resolvers (ISP or open ones) operating to answer users' queries. Interestingly, the HTTPS fraction in DNS-Incoming is smaller than in DNS-Outgoing, as, for such a query to reach the campus resolver, the following two conditions must hold: (i) a client must issue an HTTPS DNS query and (ii) its local resolver must support HTTPSDNS records. In the following, we show that not all local resolvers are already updated to support it. We now dissect HTTPS DNS adoption by infrastructure, thus showing the response rate to HTTPS queries in DNS-Outgoing separately by the DNS server's autonomous system. We use the MaxMind GeoLite database to map an IP address to the corresponding Autonomous System ([[https://dev.maxmind.com/](https://dev.maxmind.com/)]([https://dev.maxmind.com/](https://dev.maxmind.com/))). Recall that DNS-Outgoing includes traffic from the campus local resolver to the authoritative name servers for the domains being queried by the campus internal clients. Thus, in these DNS transactions, the server IP represents the authoritative DNS server for the queried domain, under the control of the corresponding organization. The top AS in terms of HTTPS queries is Google, which accounts for 27% of all HTTPS queries, followed by Amazon at 21%. Cloudflare ranks 5 th with 6%, while other ASes, such as Apple and Fastly, each account for less than 0.9%. Interestingly, among the top 100 ASes in terms of HTTPS queries, only 26 responded at least once, meaning that most operators do not support HTTPS DNS records at all. To quantify HTTPS deployment within operators, we measure the percentage of queries that are successfully answered. In Figure 2, we break down this number by the top 10 ASes in terms of HTTPS response ratio, among those receiving at least 10,000 HTTPS queries per day. Cloudflare leads with an approximately 48% response rate, meaning that 48 out of every 100 HTTPS queries are answered by the Cloudflare authoritative DNS server, while the rest go unanswered. This aligns with Cloudflare's unique role in supporting HTTPS DNS standardization and deployment as a means of offering ECH for hosted services [15]. Facebook ranks second, but the response rate is as low as 15%, followed by Google and Apple at 4.2% and 1.5%, respectively. The remaining ASes, such as Amazon and Akamai, exhibit response rates below 0.1%. Interestingly, some of the most frequently targeted ASes by HTTPS DNS queries--such as Amazon (21%), Microsoft (18%), and Akamai (9%)--have response rates below 0.1%.