What is Domain fronting? and how it is different from a VPN?

1 Answer 1


Domain fronting is a technique of exploiting HTTPS/TLS protocol specifics to obfuscate the actual server domain and avoid censorship. Essentially, domain fronting just hides the server's name that is exposed by SSL/TLS otherwise. The actual communication is encrypted anyway.

In one configuration, a large hosting service such as Amazon S3 or Google App Engine uses a shared SNI certificate containing both a common and target HTTPS domains. The domain name of the actual, blocked endpoint is only communicated after the establishment of an encrypted HTTPS connection, in the HTTP Host header, making it invisible to censors. This can be done if the blocked and the innocuous sites are both hosted by the same large provider, such as Google App Engine.

Other configurations allow a content delivery network's common HTTPS certificate and infrastructure to act as a reflector through to the target server behind.

These techniques work by using different domain names at different layers of communication. The domain name of an innocuous site is used to initialize the connection. This domain name is exposed to the censor in clear-text as part of the DNS request and the TLS Server Name Indication. For any given domain name, censors are typically unable to differentiate circumvention traffic from legitimate traffic. As such, they are forced to either allow all traffic to the domain name, including circumvention traffic, or block the domain name entirely, which may result in expensive collateral damage.


VPN is the use of an encrypted tunnel between two points on the Internet, forming a logical link. VPN encrypts everything running over the link, the only thing visible from the outside are the endpoints and the amount of traffic.

Both may be used for the same purpose - avoid Internet censorship - but they are completely different things.

  • So there are no "two points" in Domain fronting? it goes directly to the intended server? And please correct me if I am wrong, Domain fronting will not work if the actual server and the wanted server are not on the same CDN?
    – maysara
    Aug 10, 2019 at 20:29
  • 1
    Essentially, domain fronting doesn't use the domain's actual SSL certificate but another one from the same hosting cluster. Doesn't necessarily need to be a CDN (although there's a greater choice of certificates there), just vhosts should suffice.
    – Zac67
    Aug 10, 2019 at 20:56
  • 1
    .Yes, the hoster can prevent this exploit. According to WP, Google and Amazon don't allow that any more.
    – Zac67
    Aug 10, 2019 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.