Towards a Complete View of Encrypted Client Hello Deployments

We present a new measurement approach to detect ECH deployments. Our method leverages standard-compliant behavior of ECH servers. This reveals a set of ECH deployments not detected by prior measurements. Prior measurements reported only one major ECH deployment (Cloudflare). Our measurements reveal another large deployment (Meta). Meta servers support ECH, but ECH configuration is not exposed via the DNS. Furthermore, we study potential latency penalties due to ECH by analyzing the time differences between ECH and non-ECH connections.