English: Analogy for the central concept in domain fronting: plain HTTP (postcard) with the real domain in its header in an envelope (TLS encryption), which is addressed to another domain on the same CDN and with the same TLS certificate. The TLS Server Name Indication (SNI) field for the initial handshake is visible in deep packet inspection, the HTTP header is hidden and reroutes to the correct address, which may be a reflector for other sensitive or censored domains.