You can now Enable Encrypted Client Hello (Encrypted SNI or ESNI/ECH) in Microsoft Edge

[HotCakeX]

How to enable Encrypted Client Hello (ECH) in Microsoft Edge version 105 and above.

Right-click on desktop shortcut of Edge browser, select properties and add this at the end of the target:

 --enable-features=EncryptedClientHello

so that it will look like this: (there is a space before --)

preferably turn on these related flags as well to improve the overall experience of this feature.

edge://flags/#dns-https-svcb
edge://flags/#use-dns-https-svcb-alpn

Make sure to go to Edge settings edge://settings/privacy and turn on Secure DNS and choose Clouldflare. now restart the browser, visit this webpage and confirm ECH is enabled.

https://defo.ie/ech-check.php

Read more about how Encrypted Client Hello is useful and how it protects your privacy.

https://blog.cloudflare.com/encrypted-client-hello/

The Use Cases and Benefits of SVCB and HTTPS DNS Record Types (this is for the flags you turned on)

https://www.domaintools.com/resources/blog/the-use-cases-and-benefits-of-svcb-and-https-dns-record-t...

Chrome platform status for ECH

https://chromestatus.com/feature/6196703843581952

[#2]

按照步骤设置后
测试通不过？

[#3]

Can we use this on Mac? If so, how?

[#4]

No, you can not, it only works to disable ECH, not to enable it.
You have to run Edge with a parameter. This policy is useless.
https://postimg.cc/B8tjxQb3 - https://postimg.cc/jW9Lv0n7

[#5]

@HYKMI 还需要在edge设置里-隐私、搜索和服务-使用安全的 DNS 指定如何查找网站的网络地址-请选择服务提供商-cloudflare的dns

[#6]

@TairikuOkami 

---

@TairikuOkami wrote:
No, you can not, it only works to disable ECH, not to enable it.
You have to run Edge with a parameter. This policy is useless.
https://postimg.cc/B8tjxQb3 - https://postimg.cc/jW9Lv0n7

---

I only talked about the command line switch though, and it does work, Group policy used to manage it doesn't enforce it like this command line switch does.

[#7]

Hello,

I tried what you said with Edge 110.0.1587.56. Cloudflare shows working at https://www.cloudflare.com/ssl/encrypted-sni/ but not https://defo.ie/ech-check.php

I did the following:

1) Enable "Use DNS https alpn" at edge://flags/#use-dns-https-svcb-alpn

(I don't see edge://flags/#dns-https-svcb )

2) Edit Edge shortcut to include --enable-features=EncryptedClientHello

3) Kill all Edge processes with "taskkill /im msedge.exe /f"

4) Open Edge and go to both sites to see if ESNI works

It shows that ESNI is working on Cloudflare site but not defo.ie. Any thoughts if the defo.ie site may be not working or something my side/ISP? My main DNS servers on my Asus router are 1.1.1.1 and 9.9.9.9 with IPv6 equivalent and utilize DoT. 

I seem to get mixed results with Secure DNS and Secure SNI when I refresh and do Check My Browser or kill msedge and try again. Secure SNI will show not working at first and Secure DNS working. When I refresh, Secure DNS will show not working but Secure SNI working. Both DNS providers support DNSSEC. Two things here Secure DNS and Secure SNI but hoping to use two DNS providers and if 9.9.9.9 doesn't support Secure SNI, is there an alternative I can try?

Thanks,

Jason

[#8]

@jasoncal84 

I just tried this again in Edge Version 114.0.1823.58 (Official build) (64-bit) and it's working 

Use the same procedure I explained in my post, it should work, just make sure Startup boost isn't on so that when you change the command line flags it will take effect immediately.

Cloudflare's website is also updated to support ECH and it detects it too.

Here i checked it with Wireshark too for this site: https://defo.ie/ech-check.php

[#9]

Not working in new Edge 115 version and startup boost is disabled.

[#10]

@yaashul 

Spoiler

---

@yaashul wrote:

Not working in new Edge 115 version and startup boost is disabled.

---

Hi,

I just checked again and it's working fine

[#11]

@HotCakeXech测试通过，当我通过Wireshark抓取数据包时，我看到了sni的真实域名，看到截图，这是怎么回事？

[#12]

@HYKMI 

Spoiler

---

@HYKMI wrote:

@HotCakeXech测试通过，当我通过Wireshark抓取数据包时，我看到了sni的真实域名，看到截图，这是怎么回事？

---

Hi, that's expected behavior. It is just for testing purposes. Real world usage isn't supposed to be like that.