The server operator publishes an ECH configuration (an HPKE public key, a public name and parameters) in the ech parameter of DNS HTTPS records (RFC 9848, on top of RFC 9460). The client sends an outer ClientHello addressed to the public name (for example a CDN's generic host) carrying the encrypted inner one in extension 0xfe0d; the server decrypts it and continues with the inner parameters. If keys are stale the server returns fresh ones and the client retries.
It only hides something when many sites share a provider and the DNS lookup itself is protected (DoH or DoT); otherwise the HTTPS record query reveals the name. Cloudflare enabled it broadly in 2023; Firefox has used it by default since version 119 (with DNS over HTTPS), Chrome began rolling it out in version 117, and nginx and other servers gained support later. Networks that rely on SNI for filtering lose that visibility, which is why some enterprises block it.