Proceedings on Privacy Enhancing Technologies 2015; 2015 (2):1–19

Blocking-resistant communication through domain fronting Abstract: We describe “domain fronting, ” a versatile censorship circumvention technique that hides the re-mote endpoint of a communication. Domain fronting works at the application layer, using HTTPS, to com-municate with a forbidden host while appearing to com-municate with some other host, permitted by the cen-sor. The key idea is the use of different domain names at different layers of communication. One domain appears on the “outside ” of an HTTPS request—in the DNS re-quest and TLS Server Name Indication—while another domain appears on the “inside”—in the HTTP Host header, invisible to the censor under HTTPS encryp-tion. A censor, unable to distinguish fronted and non-fronted traffic to a domain, must choose between allow-ing circumvention traffic and blocking the domain en-tirely, which results in expensive collateral damage. Do-main fronting is easy to deploy and use and does not re-quire special cooperation by network intermediaries. We identify a number of hard-to-block web services, such as content delivery networks, that support domain-fronted connections and are useful for censorship circumvention. Domain fronting, in various forms, is now a circumven-tion workhorse. We describe several months of deploy-ment experience in the Tor, Lantern, and Psiphon cir-cumvention systems, whose domain-fronting transports now connect thousands of users daily and transfer many terabytes per month