DNS
The domain name system translates human-readable hostnames into IP addresses, and where that lookup happens can quietly expose your real location.
DNS is the internet's address book. Nothing can be reached by name until that name has been turned into an IP address, so before your browser fetches a single byte of a page it asks a resolver where that hostname lives. It runs constantly, invisibly, underneath everything else you do online.
For anyone using a proxy, the question that matters is not what DNS is but WHERE the lookup happens, because the lookup is a separate conversation from the one you are proxying. Your request can travel through an exit in Frankfurt while the question 'what is the address of this site' was asked and answered by your own internet provider's resolver at home.
When that happens you have told two different stories at once. The destination sees a German address; your own resolver, and anyone with visibility of it, saw you look up that exact hostname at that exact moment from your real location. The proxy did its job perfectly and the leak happened beside it.
This is why SOCKS5's remote resolution matters more than its feature list suggests. Handing the proxy a hostname instead of an address you resolved yourself moves the lookup to the exit, so the question is asked from where your traffic appears to be. Most clients expose this as a separate setting, and it is off more often than people expect, which is why the leak is common among people who believe they are covered.
The other reason it deserves attention is timing rather than content. Even where the traffic itself is encrypted, a resolver observes which names you asked about and when, and that sequence is often enough to reconstruct what you were doing. Encryption of the page does not conceal the question that preceded it.
Resolvers also differ in what they return, which is a smaller but real effect. Large sites answer DNS queries with addresses close to the resolver that asked, so resolving locally while exiting elsewhere can route you to infrastructure near YOU rather than near your exit, quietly undermining the geography you paid for.
Frequently asked questions
What is a DNS leak and how do I test for one?
It is when your traffic goes through the proxy but your name lookups do not, so your own resolver sees every hostname you visit. Test it by loading any DNS leak checker while connected through the proxy: it reports which resolvers answered on your behalf. If they belong to your home internet provider rather than to somewhere consistent with your exit, you are leaking.
Does a proxy handle DNS automatically?
Not necessarily, and assuming it does is how most leaks happen. An HTTP proxy given a full URL generally resolves the name at its end. A SOCKS5 proxy can do so if the client sends a hostname, but many clients resolve locally first and hand over an address instead, which defeats it. The behaviour depends on your client's configuration, not on the proxy alone.
Should I use a public DNS resolver with my proxy?
It changes who sees your lookups rather than removing the exposure. Switching from your provider's resolver to a public one moves that visibility to the public operator and does not put the lookup behind your proxy. Resolving remotely at the exit is the fix; changing resolvers is a different, smaller adjustment.
Can DNS reveal my location even with a proxy?
Yes, in two ways. The resolver that answered your query knows where the question came from, which exposes your real network to anyone with visibility of it. And large sites hand out addresses near whichever resolver asked, so resolving from home while exiting abroad can route you to infrastructure near you and undercut the location you were trying to present.
Back to the full glossary.