Proxy DNS leaks: when the sites you visit show up outside the proxy
A DNS leak is a name lookup that goes around your proxy. Before your software can connect to a site, the site’s name has to be turned into an address. If your own computer does that, the lookup goes to your own network’s DNS server, which then sees every site you visit, even though the sites themselves only see the proxy. With an HTTP proxy, and with a SOCKS5 proxy set to let the proxy look names up, the name travels to the proxy and the lookup happens there. The leak comes from SOCKS4, and from SOCKS5 in software that looks names up first: in curl and Python’s Requests, write
socks5h://instead ofsocks5://.
Where SOCKS5 is included today, checked up to Oct 24, 2026:
- Residential: 20 of the 21 providers whose pages list protocols include SOCKS5 (not HydraProxy).
- Datacenter: 15 of the 15 providers whose pages list protocols include SOCKS5.
- ISP: 20 of the 20 providers whose pages list protocols include SOCKS5.
- Mobile: 14 of the 14 providers whose pages list protocols include SOCKS5.
Counted on the plans whose provider's page names the protocols. Over SOCKS5, whether the proxy or your computer looks names up is your software's setting, not the plan's. The cheapest SOCKS5 plans at your amount.
Answer · The live comparison uses prices checked up to Oct 24, 2026; every figure in the text keeps the date it was checked.
On this page
- Lookup at the proxy: an HTTP proxy, socks5h://, or Chrome's SOCKS5
- Your computersends the proxy the name example.com
- The proxylooks the name up on its own network, then connects
- The sitesees the proxy's address
- Lookup on your computer: socks5:// in curl or Requests, or SOCKS4
- Your DNS serveris asked for example.com first, so it learns the name
- Your computersends the proxy the address it got back
- The proxyconnects to that address
- The sitestill sees the proxy's address
Where the lookup happens
With an HTTP proxy, your software hands the proxy the site’s name: the whole address for a plain http:// page, or the name and port in the CONNECT request that opens the tunnel for an https:// one (RFC 9110, section 9.3.6). The proxy looks the name up. Chrome’s proxy documentation puts it plainly: with an HTTP proxy, “name resolution is always deferred to the proxy” (Chromium: proxy support).
SOCKS5 can carry either a name or an address (RFC 1928), so the software decides:
| Software and setting | Who looks up the name |
|---|---|
| Any program, HTTP proxy | The proxy |
curl or Python Requests, socks5h:// |
The proxy |
curl or Python Requests, socks5:// |
Your computer |
| Chrome, SOCKS5 | The proxy, always |
| Firefox, SOCKS5 | Depends on its network.proxy.socks_remote_dns setting |
| Any program, SOCKS4 | Your computer |
The curl and Requests rows come from Requests’ own documentation: “Using the scheme socks5 causes the DNS resolution to happen on the client, rather than on the proxy server. This is in line with curl, which uses the scheme to decide whether to do the DNS resolution on the client or proxy. If you want to resolve the domains on the proxy server, use socks5h as the scheme” (Requests: SOCKS). The Chrome, Firefox and SOCKS4 rows come from Chromium’s proxy documentation, which adds that SOCKS4 can only reach IPv4 addresses: it sends the proxy a four-byte address, never a name. SOCKS4 vs SOCKS5 covers the two versions.
What a leak shows, and to whom
A leaked lookup tells your DNS server, usually your internet provider’s, your office network’s or the public resolver you chose, which site names you asked for, and when. It does not show the pages, and the site still sees the proxy’s address, not yours.
It can still matter in two ways. If the reason for the proxy is that your own network should not see where you go, a leak defeats it. And a lookup made at home is answered for home: a DNS answer can depend on the network the question came from (RFC 7871), so the address you get back can be one picked for your location rather than for the proxy’s.
A proxy set in one program covers that program only. Every other app on the computer keeps looking names up, and connecting, the usual way. To move a whole device onto another network, a VPN is the tool; what is a proxy server sets the two side by side.
How to check
Load a DNS leak test page in the browser or program that uses the proxy. Such a page has your software look up names that only it knows, then lists the DNS servers that asked for them. If those servers belong to your own internet provider rather than to the proxy’s network, your lookups are going around the proxy: switch the scheme to socks5h://, turn on the remote lookup setting, or use the provider’s HTTP endpoint instead.
For a script, the scheme is the whole fix. In a browser, also check that it is set to use the proxy for every connection, not only for some sites.
Price it for your amount
Today's checkout totals, every billing type competing. Change the amount to recalculate.
Geonode
$34.65Residential monthly subscription · Monthly
Checked Oct 24, 2026 · $0.69 per GB used
Buy at Geonode →GB and IP packages use separate amounts and billing units.