diff --git a/transport/internet/tls/ech.go b/transport/internet/tls/ech.go
index 9de124c1c2e2..4755cd4fd67c 100644
--- a/transport/internet/tls/ech.go
+++ b/transport/internet/tls/ech.go
@@ -234,6 +234,9 @@ func dnsQuery(server string, domain string, sockopt *internet.SocketConfig) ([]b
 		if err != nil {
 			return nil, 0, err
 		}
+		// h2c: in config is just for claim
+		// change scheme to https and expect outbound to handle TLS (freedom + tlsSetting)
+		req.URL.Scheme = "https"
 		req.Header.Set("Accept", "application/dns-message")
 		req.Header.Set("Content-Type", "application/dns-message")
 		utils.TryDefaultHeadersWith(req.Header, "fetch")