Editing How to bypass ISP censorship (section)

= Emerging Privacy Protocols (DNS/TLS) =

== DNS-over-HTTPS (DoH) / DNS-over-TLS (DoT) / DNS Crypt ==
Protocols that encrypt DNS queries to prevent tracking and poisoning.
* '''DoT:''' Dedicated port 853.
* '''DoH:''' Uses port 443 (standard web traffic).
* '''DNS Crypt:''' Encrypts payloads using public keys.

'''PROs:'''
* <span style="color:green">'''Bypasses DNS Filtering:'''</span> Primary benefit.
* <span style="color:green">'''Stealthy (DoH):'''</span> Indistinguishable from HTTPS.

'''CONs:'''
* <span style="color:red">'''DoT is Easily Blocked:'''</span> Port 853 can be blocked.
* <span style="color:red">'''Does Not Bypass DPI:'''</span> Useless if SNI or IP is blocked.

== Encrypted Client Hello (ECH) ==
A TLS 1.3 extension that encrypts the SNI, closing the metadata leak in HTTPS.

'''PROs:'''
* <span style="color:green">'''Defeats SNI-Based DPI:'''</span> Makes this class of censorship obsolete.
* <span style="color:green">'''Proactive & Native:'''</span> Protects all users by default when adopted.

'''CONs:'''
* <span style="color:red">'''Not Yet Standard:'''</span> Not universally deployed.
* <span style="color:red">'''Already Being Blocked:'''</span> Russia blocks ECH directly; China blocks encrypted DNS to prevent ECH.