I know that even with DoT or DoH the target of the connection is leaked due to the use of SNI in the client hello (and that ESNI/ECH are proposed solutions), but what I can't figure out is does SNI get used 100% of the time (assuming a TLS connection)?
If it's not 100% of the time, then when does it or doesn't it get used?
By "used" I mean is it always present in the client hello
making TLS connections ALWAYS leak their target