Why this matters:How to recognise this workaround on your side, and what closes it on your side — without telling you how to do the workaround.
How common it is: ECH is a documented IETF protocol. Deployment prevalence is uneven and not quantified for child devices specifically.
Detection
A browser on the device negotiates an ECH-enabled connection; the router sees an encrypted ClientHello to a server without the destination hostname; a hostname-based content filter no longer matches.
Fix (technical)
Do not design a content rule around SNI visibility alone. Use endpoint controls, DNS policy where the family resolver still receives the query, or account-level controls that attach to the service itself.
Fix (relational)
ECH is a protocol feature the industry is rolling out. Treat a hostname-classifier that has stopped working as a technology change, not as evidence the child did something.
Residual risk
ECH deployment is uneven. Some destinations still present the hostname in the clear; the gap is the trend, not a universal current state.
Sources
-
www-rfc9849-ech
-
rfc9490-mten
Why trust this page?
Belief-disclosure in plain language. Everything the page claims is sourced; instructions are tested against the software version stated above; nothing is bought or affiliate-linked.
- Standing of evidence
- Primary (first-hand or regulatory source)
- Last verified
- 2026-08-20
Sources used on this page, in the order they appear:
- No external sources were cited.