SSL/TLS's servername extension puts those names in plaintext just like DNS. The popular browsers all include this extension even when the website does not require it.

As such, one can get a list of names by snooping on HTTPS traffic, instead of DNS traffic:

https://github.com/kontaxis/snidump

ESNI-enabled software and Clouflare's ESNI-enabled CDN is an option, but you have to keep making DNS queries to get a key that changes every hour.