AnyProxy

Get Pro
Glossary · Web tech

SNI inspection

Also calledsni filteringtls sni block
Definition

SNI inspection is a filtering technique: a firewall reads the site name from the start of an HTTPS connection and cuts or logs the connection if the name is on a list.

Explanation

In depth

Every classic HTTPS connection begins with the browser naming the site in readable text, in the SNI field of the TLS ClientHello. SNI inspection is what a filter does with that: it reads the name, compares it with a blocklist and, on a match, drops the packets or sends a reset. It needs no decryption and no fake certificate, and it works even when the user's DNS is encrypted. That makes it popular with national filters and office firewalls. The visible symptom is usually a connection reset or timeout rather than a block page, because the filter cannot inject a page into an encrypted session. OONI's 2025 Iran study saw this on Irancell (AS44244): connections reset right after the ClientHello. In OONI's 15 Jul - 15 Oct 2026 data for vimeo.com in Iran, Irancell produced 465 anomalies and 374 confirmed blocks out of 920 tests. Ways around it: Encrypted Client Hello, where the site and browser support it and the network does not block ECH itself; a VPN; or a web proxy. Through a web proxy the only name your browser sends is the proxy's host name, so the filter has nothing to match unless the proxy itself is listed.

In practice

SNI inspection in the real world

On Irancell (AS44244), OONI's 2025 Iran study found connections reset immediately after the browser's ClientHello, the exact moment the site name is sent. Russia applied the same idea to ECH in November 2024. Filters matched connections that combined the ECH extension with the public name cloudflare-ech.com and blocked them, so a privacy feature became one more name to match. Through AnyProxy the filter in your country sees only sg., fr. or us.anyproxy.site. The destination name is sent later, from the proxy's data centre.

Sources: OONI — Iran censorship study (2025) · OONI Explorer: vimeo.com tests in Iran, 15 Jul - 15 Oct 2026 · Risky Biz News — Russia blocks Cloudflare ECH connections (Nov 2024)

We checked

The destination name leaves from the proxy's data centre, not your network (15 Oct 2026)

Cloudflare trace page opened through AnyProxy Frankfurt, listing colo=FRA, loc=DE, http=http/2, tls=TLSv1.3 and sni=plaintext, with the IP line hidden

Open Cloudflare's diagnostic page one.one.one.one/cdn-cgi/trace through the Frankfurt region

Worked · FR exit · 2026-10-15

Page loaded as plain text: colo=FRA, loc=DE, tls=TLSv1.3, http=http/2, sni=plaintext, kex=X25519MLKEM768. The ip= line (the proxy's exit address) was hidden before the screenshot.

Questions about SNI inspection

How is SNI inspection different from DNS blocking?
DNS blocking lies about the address before you connect. SNI inspection lets the lookup succeed and cuts the connection when the site name appears in the handshake. Changing DNS fixes the first, not the second.
Does a VPN beat SNI inspection?
Usually, because the real handshake travels inside the tunnel. But networks in Iran and Russia also fingerprint and block VPN protocols themselves.
Why does a web proxy get past it?
Your browser only names the proxy host. Unless that name is on the filter's list, there is nothing to match.

Related terms

TLS SNISNI (Server Name Indication) is the field at the start of an HTTPS connection where your browser names the site it wants, usually in readable text.DPI (Deep Packet Inspection)Deep packet inspection (DPI) is network equipment that looks beyond a packet's addresses into its contents and patterns, to recognise and block or slow specific sites and apps.ESNI / ECHEncrypted Client Hello (ECH) encrypts the opening message of an HTTPS connection, hiding the real site name (SNI) from the network; it replaced the earlier ESNI draft.TLS handshakeThe TLS handshake is the opening exchange of every HTTPS connection, in which browser and server agree on encryption keys and the server proves which site it is.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page