DNS leak
When your DNS queries bypass the proxy and reveal your real network or location despite your visible IP being masked.
A DNS leak is the anonymity failure that leaves no trace of itself. Your traffic routes through the proxy exactly as configured, and the name lookups, the step that turns a hostname into an address before any traffic can flow, go out through your own local resolver instead. Everything works. Your exit IP checks out. And the resolver that answered has watched you look up every destination you visited.
It happens because resolution is a separate conversation from the request, and most software treats it that way by default. Your client asks 'what is the address for this hostname', gets an answer from whatever resolver the operating system was configured with, and only then opens a connection through the proxy to that address. The proxy was never consulted about the question, only about the destination.
Which is what makes it so easy to miss. There is no error, no warning and nothing visibly different, so the only way to discover it is to go looking. Someone who checks their exit IP, sees the right country, and stops there will never find out.
The exposure is real even when the pages themselves are encrypted, because the leak is metadata rather than content. A resolver sees which hostnames were asked about and in what order and at what time, and that sequence usually reconstructs what you were doing without needing a single byte of the page.
The fix is to resolve at the exit rather than at home. SOCKS5 supports this natively by accepting a hostname instead of a pre-resolved address, and most decent tooling exposes it as a setting, frequently one that is off by default. HTTP proxies given a full URL generally resolve at their end already.
There is a second-order effect worth knowing beyond privacy. Large sites answer DNS queries with server addresses near whichever resolver asked, so resolving at home while exiting abroad can route you to infrastructure near YOU, quietly undermining the geography you were paying for even when nobody is watching your lookups.
How it works
- 1.Connect through the proxy as you normally would.
- 2.Load any DNS leak test service, which asks your browser to resolve a set of unique hostnames it controls.
- 3.It records which resolvers actually performed those lookups and shows them back to you.
- 4.Resolvers belonging to your own internet provider mean you are leaking; the proxy carried your traffic and not your questions.
- 5.Fix it by enabling remote DNS in the client, then re-run the test rather than assuming the setting took effect.
Frequently asked questions
How do I test for a DNS leak?
Connect through the proxy and load any DNS leak test service, which resolves unique hostnames it controls and reports which resolvers answered. If they belong to your own internet provider rather than to something consistent with your exit, you are leaking. Test after every configuration change, because the setting frequently does not apply where you expect.
Does a SOCKS5 proxy prevent DNS leaks automatically?
It makes prevention possible rather than automatic. SOCKS5 can accept a hostname and resolve it at the exit, but only if your client sends a hostname. Many clients resolve locally first and hand the proxy an address, which defeats it entirely. The behaviour depends on your client's configuration, not on the protocol alone.
Is a DNS leak dangerous if all my traffic is HTTPS?
It still exposes you, because the leak is metadata rather than content. HTTPS hides what is on a page; it does not hide that you asked where that page lives. A resolver observing which hostnames you looked up, in what order and when, can usually reconstruct your activity without ever seeing the pages.
Will changing to a public DNS resolver fix it?
No, it moves the exposure rather than removing it. Switching from your provider's resolver to a public one means a different operator sees your lookups, and they still originate from your real network rather than from behind the proxy. Resolving remotely at the exit is the actual fix.
Back to the full glossary.