Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Signal used domain fronting as a censorship-circumvention technique in 2016, routing connections through popular cloud services so they could appear to target a different domain from the one ultimately handling them. Signal said changes by Google and Amazon made that approach largely non-viable in the countries where it had deployed it. Its later guidance instead describes built-in circumvention and TLS proxies for Android and iOS; those proxies are not domain fronting.
What domain fronting meant for Signal
Domain fronting used shared cloud infrastructure to make a connection appear to be addressed to a popular service while routing the request to Signal. In Signal’s explanation, the hostname visible in the TLS Server Name Indication (SNI) field could differ from the service that ultimately processed the request. That separation was possible on some cloud infrastructure because TLS termination and request processing were handled separately.
Signal’s December 21, 2016 account said that, after reports of unreliable service in Egypt and the United Arab Emirates, it found some internet service providers blocking communication with Signal. Signal introduced an Android censorship-circumvention feature for users with Egyptian and UAE phone numbers. Connections could resemble ordinary HTTPS requests to a popular domain such as www.google.com. The theory was that blocking the apparent front could also disrupt access to a much broader service. Signal described the goal this way: “The goal for an app like Signal is to make disabling internet access the only way a government can disable Signal.” Signal’s 2016 announcement
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The feature was designed to work without user configuration. It did not mean that Signal was hosted by Google or that Google could read Signal messages; the domain was used as a front for routing through shared infrastructure.
#1 Best Overall
Why Signal stopped using domain fronting
In a May 1, 2018 account, Signal said Google planned changes to stop domain fronting. Signal then shifted to Amazon CloudFront, but said Amazon introduced protections intended to prevent use of a third-party domain in this way. Signal quoted an AWS CloudFront service-terms notice in its post; the email excerpt was redacted and reproduced by Signal.
Signal concluded that domain fronting was largely non-viable in the countries where it had enabled the technique. That is Signal’s account of those providers’ changes and its own deployment at the time—not a claim that domain fronting is impossible everywhere today or a current country-by-country blocking report. Signal summarized the outcome: “The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. In the end, the rest of the internet didn’t like that plan.” Signal’s 2018 account
Domain fronting and Signal’s later TLS proxy compared
| Aspect | Historical domain fronting | Signal TLS proxy |
|---|---|---|
| Infrastructure | Shared infrastructure from large cloud services or CDNs, used as a popular front. | A proxy server that forwards bytes to Signal; it may be run by a volunteer. |
| Setup for a user | Signal said its 2016 Android feature required no user configuration. | Connect through a proxy link or enter proxy details in the app. |
| Blocking risk | Blocking a popular front could carry broader collateral costs; provider changes made Signal’s use largely non-viable in the countries where it had been enabled. | An individual proxy address or widely shared link can be blocked. |
Signal’s later term is TLS proxy, not domain fronting. In Signal’s description, the proxy relays bytes while the Signal client negotiates its normal TLS connection with Signal endpoints through the tunnel. Signal says the traffic remains opaque to the proxy operator. This describes the proxy’s role; it does not establish anonymity or protection from every kind of network observation. Signal’s 2024 explanation
How to connect to Signal through a proxy on mobile
Signal’s support instructions cover Android and iOS. App menus can change, so consult the live Signal Proxy Support guide if the labels on your device differ.
Use a proxy link
- Obtain a Signal proxy link from someone you trust. Signal says public links and popular proxy addresses can be blocked, so a privately shared address may be more useful.
- Tap the link on your Android or iOS device and follow the prompt to open it in Signal and connect.
- Check the connection status in Signal. If the proxy stops working, the address may be blocked or unavailable; try another trusted proxy link if you have one.
Configure the built-in circumvention option
Signal’s August 2024 post describes a built-in circumvention feature and gives this Android path: Signal Settings > Data and Storage > Use proxy. For current options and platform-specific steps, use the live support guide, since settings and availability can change. Signal’s current support article says this phone proxy technique is not currently possible on Desktop; it says the organization is exploring options.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What a volunteer needs to run a Signal proxy
Signal’s support guide says a proxy operator needs a server with ports 80 and 443 available and a domain or subdomain pointed to the server’s IP address. Signal’s September 2022 post characterized the proxy as lightweight and said an inexpensive small VPS could handle hundreds of concurrent users. That capacity figure is Signal’s dated claim, not independently reported performance testing. No particular hosting provider is endorsed by Signal. Signal’s 2022 request for proxy operators
Rank #4
- Set up a server with ports 80 and 443 available.
- Point a domain or subdomain to the server’s IP address.
- Follow Signal’s current proxy setup instructions and share the resulting address privately when practical.
A proxy is a way to relay Signal traffic, not a VPN and not a guarantee that a blocked connection will become available. Individual proxy addresses can be identified and blocked, and no source here establishes that any particular address is currently reachable from a particular country or network.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
