diff --git a/common/tls/client.go b/common/tls/client.go
index 7b4149a38..e372d183b 100644
--- a/common/tls/client.go
+++ b/common/tls/client.go
@@ -89,20 +89,18 @@ func (d *defaultDialer) dialContext(ctx context.Context, destination M.Socksaddr
 		return nil, err
 	}
 	tlsConn, err := aTLS.ClientHandshake(ctx, conn, d.config)
-	if err == nil {
-		return tlsConn, nil
-	}
-	conn.Close()
-	if echRetry {
+	if err != nil {
+		conn.Close()
 		var echErr *tls.ECHRejectionError
-		if errors.As(err, &echErr) && len(echErr.RetryConfigList) > 0 {
+		if echRetry && errors.As(err, &echErr) && len(echErr.RetryConfigList) > 0 {
 			if echConfig, isECH := d.config.(ECHCapableConfig); isECH {
 				echConfig.SetECHConfigList(echErr.RetryConfigList)
+				return d.dialContext(ctx, destination, false)
 			}
 		}
-		return d.dialContext(ctx, destination, false)
+		return nil, err
 	}
-	return nil, err
+	return tlsConn, nil
 }
 
 func (d *defaultDialer) Upstream() any {