Glossary · Web tech

SNI inspection

Also calledsni filteringtls sni block

Definition

SNI inspection is a firewall technique that reads the destination hostname from the TLS handshake and blocks connections to specific domains.

Explanation

In depth

Enterprise firewalls, national-level filters (China's Great Firewall, Iran's DPI), and corporate proxy avoidance tools all use SNI inspection. Because SNI is sent in plaintext at the start of every HTTPS connection, the firewall does not need to decrypt anything — it just reads the hostname and applies policy. Traditional workarounds: domain fronting (route through a big allowed domain like a CDN, so the SNI is the CDN's but the actual destination is elsewhere), or ECH (Encrypted Client Hello, which hides the SNI). Web proxies defeat SNI inspection at the client's end because the SNI your browser sends is for the proxy domain (anyproxy.site), not the destination — the destination is inside the encrypted body.

Related terms

TLS SNITLS Server Name Indication (SNI) is a field in the TLS handshake that names the destination hostname — visible to any network observer even when the connection itself is encrypted.DPI (Deep Packet Inspection)Deep packet inspection reads not just packet headers but payload contents to identify and filter specific protocols, applications, or destinations.ESNI / ECHEncrypted Client Hello (ECH) hides the TLS SNI hostname from network observers — the modern replacement for the earlier ESNI proposal.TLS handshakeThe TLS handshake is the initial exchange between client and server that agrees on encryption keys and verifies the server's identity before any application data flows.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page