Back
Featured image of post Enabling DOH and ECH Encryption in Chrome
Tinkering

Enabling DOH and ECH Encryption in Chrome

Enabling DOH and ECH in your browser to enhance security and privacy

Table of contents

TL;DR / [Geek Summary]:

  • Privacy Hardening: Enable DoH (DNS over HTTPS) to bypass DNS hijacking and snooping.
  • Deep Encryption: Force-enable ECH via chrome://flags to encrypt the SNI handshake.
  • Pro Tip: Pair with TUN mode proxies to prevent traffic leaks and ensure full-stack privacy.

# Materials Needed

  • Chrome Browser

# Steps

Enabling DOH

  1. Open Chrome 1. In your browser settings, click “Privacy and Security” → “Security” in sequence.

Corresponding page

  1. Go to “Advanced” and enable “Use secure DNS”. Then select a DNS provider (if you don’t know, just choose Cloudflare).

Options

Enable ECH

Open this address in your Chrome browser: chrome://flags/#encrypted-client-hello, and change the Encrypted ClientHello option to Enabled.

Enable it

# Detection

  1. Open this CF website: https://www.cloudflare.com/zh-cn/ssl/encrypted-sni/ , and click the “Check my browser” button.

Corresponding detection page

  1. If you see a checkmark under “Secure DNS”, it means DOH is enabled. If you see a checkmark under “Secure SNI”, it means ECH is enabled.

Checking all the boxes is powerful

# Notes

If you are using a software router, this doesn’t matter and you don’t need to worry about it. If you are using other clients, you need to enable TUN. The mode allows it to take over all traffic; otherwise, the browser will not use its own DOH service but will instead hand it over to the proxy software for resolution, which in turn will be sent to the node server for DNS resolution, resulting in invalid traffic.