Cybersecurity glossary
What is Domain Fronting?
Learn what domain fronting is, how mismatched SNI and HTTP Host headers hide traffic behind popular CDNs, why providers disabled it, and what security teams should know today.
Definition
Domain fronting is a technique that makes TLS connections appear to target a popular front domain—often via SNI—while the HTTP request Host header routes traffic to a different backend domain on the same CDN or multi-tenant infrastructure, obscuring the true destination.
Why domain fronting mattered
Network filters often allow popular destinations and block lesser-known malicious domains. Domain fronting tried to borrow the reputation of a major CDN or cloud hostname during TLS while delivering application traffic to a different customer backend on the same shared edge.
To a simple network observer, the connection looked like traffic to a harmless front domain. After the CDN terminated TLS, the HTTP Host header selected another domain. That mismatch powered both privacy tools and malware C2 until large providers shut the behavior down.
How classic domain fronting worked
Choose a front domain
Pick a widely allowed domain hosted on a multi-tenant CDN or cloud front door.
Connect with front SNI
The TLS ClientHello indicates the front domain so certificates and path look legitimate.
Send a different Host header
After TLS reaches the shared edge, HTTP requests name the hidden backend domain.
Edge routes by Host
If the platform allowed mismatch, traffic reached the attacker or circumvention backend.
Observers see the front
DNS and SNI point at the popular domain, complicating destination-based blocking.
Providers close the gap
Modern edges typically require SNI and Host to align, ending classic fronting.
Fronting versus related concepts
| Concept | Difference |
|---|---|
| Domain fronting | SNI/front domain disagrees with HTTP Host on shared infrastructure |
| Domain hijacking | Attacker gains control of DNS/registrar for a real domain |
| Fast-flux DNS | Rapidly changing DNS answers for malicious hosting resilience |
| CDN reverse proxy | Legitimate Host/SNI alignment to an owned backend |
Security implications today
Provider hardening
Major CDNs largely require matching names, reducing opportunistic fronting.
Residual lookalikes
Related covert techniques may still abuse shared hosting, encryption, or policy gaps.
Enterprise monitoring
TLS inspection points that see SNI and Host can still flag mismatches where visible.
Malware history
Older implants hard-coded front domains; threat intel still references the pattern.
Practical checklist
- Assume classic domain fronting is disabled on major CDNs; verify your own edge rejects SNI/Host mismatches.
- If you operate multi-tenant TLS infrastructure, enforce consistent name selection end to end.
- Monitor for malware using popular cloud hostnames as apparent destinations.
- Do not confuse legitimate CDN usage (matching Host/SNI) with fronting.
- Review acceptable-use and abuse processes for customer backends that may attempt covert routing.
- Teach analysts the SNI versus Host distinction for HTTPS investigations.
- Pair destination controls with endpoint detection; encrypted covert channels evolve.
- Track provider security bulletins when evaluating residual fronting-like risks.
The practical takeaway
Domain fronting hid a true HTTP destination behind a popular TLS front name on shared CDN infrastructure. It mattered for censorship resistance and for malware blending.
Today, major providers generally block the classic mismatch. Understanding fronting still helps analysts interpret HTTPS telemetry, harden multi-tenant edges, and recognize historical C2 patterns—without mistaking ordinary CDN traffic for an attack.
Related security terms
HTTPS
The TLS-protected HTTP transport that domain fronting manipulates through name mismatches.
SSL/TLS
The handshake layer where SNI indicates an apparent destination domain.
Domain Name System (DNS)
Resolution often points fronting traffic at large shared CDN edge addresses.
Man-in-the-Middle (MITM)
Network observers see the front domain more clearly than the hidden backend Host.
Frequently asked questions
What is domain fronting in simple terms?
Domain fronting is a way to hide the real website you are talking to by using a well-known domain during the TLS handshake while sending the real target in the HTTP Host header on shared CDN infrastructure that used to allow the mismatch.
Why was domain fronting used?
It was used for censorship circumvention and also abused by malware for command-and-control that blends into traffic toward popular cloud or CDN domains.
Do major CDNs still allow domain fronting?
Major providers largely disabled classic domain fronting after abuse and policy concerns. Assume modern CDNs reject SNI/Host mismatches, though related techniques and misconfigurations can still appear.
What is the difference between SNI and Host?
SNI is a TLS handshake extension naming the intended virtual host for certificate selection. The HTTP Host header names the application host after decryption at the edge. Fronting exploited cases where they could differ.
Is domain fronting the same as domain hijacking?
No. Hijacking takes control of a domain’s DNS or registrar settings. Fronting abuses multi-tenant routing behavior without stealing the front domain itself.
How can defenders detect historical fronting patterns?
Look for TLS SNI and HTTP Host disagreements at TLS-inspecting gateways, unusual CDN edge access patterns, and malware that hard-codes popular front domains.
Is domain fronting illegal?
Legality depends on jurisdiction and use. Security teams should treat it as a high-risk covert-channel technique and follow law and provider acceptable-use policies.
References
Explore authoritative guidance and frameworks related to domain fronting.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.