[icebraining]

Also, if they can see your DNS, chances are they can see the TLS handshake, so SNI would leak the domain anyway. But a VPN should encrypt both.