Vercel CDN now supports Encrypted Client Hello (ECH) for all domains managed by Vercel DNS. ECH closes the last plaintext gap in HTTPS connections: the Server Name Indication field in the TLS handshake, which previously exposed the exact hostname a client was connecting to. Network observers now see only a connection to Vercel's shared ECH hostname, vercel-ech.com.
The feature requires no configuration. Vercel enables ECH automatically at the platform level wherever the client supports it. Chrome, Edge, and Firefox all ship with ECH support in recent versions.
The implementation details, including how Vercel's CDN layers encryption end to end, are documented in their CDN encryption reference. That documentation is worth reading if you want to understand what ECH actually protects against versus what it does not, and where the remaining attack surface sits.
[READ ORIGINAL →]