DNS leak test: is your proxy covering your lookups?

What a DNS leak actually is

When you type example.com, your browser first asks a DNS resolver, a kind of directory service, for that name's IP address. Only after it gets the answer does it connect to the site, and that connection is the part that normally travels through your proxy or VPN.

A leak is when that first question goes to your internet provider's resolver instead of through the proxy. The website itself can't tell. Your provider, though, sees the name of every site you look up, even though the pages themselves arrive through the proxy. Resolvers often keep logs of these questions too, and logs can be handed over on legal request, sold, or stolen in a data breach.

Why it happens with proxies

A proxy can only look up a name if your app hands it the name. Some apps look the address up themselves first, using your computer's normal settings, and then pass the proxy a ready-made number. The page still loads through the proxy, but the lookup has already gone out over your own connection.

The usual culprits:

• Apps that find the address before using the proxy - your computer's own DNS settings answer the question, and the proxy is only given the number.
• SOCKS4 and SOCKS5 (two common ways of connecting to a proxy) - SOCKS4 can't pass lookups to the proxy at all. SOCKS5 can, but only when the app is told to, so look for a setting called "remote DNS" or "proxy DNS".
• A VPN set to split tunnelling, where only some traffic goes through it - if its DNS settings aren't right, lookups can take the other route.
• A browser's own secure DNS setting (DNS over HTTPS, or DoH) - Firefox and Chrome can send lookups to a service such as Cloudflare or Google. That setting is separate from your proxy settings, so check where it points.

Fixing a DNS leak

In your browser

• Firefox: open Settings → Network Settings and tick "Proxy DNS when using SOCKS v5".
• Chrome: start it with --proxy-server="socks5://host:port" --host-resolver-rules="MAP * ~NOTFOUND, EXCLUDE proxy", or install an extension that sends lookups through the proxy.
• Profile ("antidetect") browsers such as Multilogin, Dolphin Anty and GoLogin send lookups through each profile's proxy by default, which is one reason people who manage accounts use them.

In a Python script

# Python requests + SOCKS5 with DNS-over-proxy
import requests
proxies = {
    'http':  'socks5h://user:pass@host:port',  # 'socks5h' = resolve via proxy
    'https': 'socks5h://user:pass@host:port',
}
requests.get('https://example.com', proxies=proxies)

Look closely: it says socks5h://, not socks5://. That extra h tells Python to let the proxy look up host names. Without it, Python does the lookup over your own connection, and that's the leak.

When an app can't send lookups through the proxy

Some programs simply have no way to send DNS through a proxy. For those, set your computer to use a well-known public resolver instead of your provider's: 1.1.1.1 (Cloudflare), 9.9.9.9 (Quad9) or 8.8.8.8 (Google). Switch on DNS over HTTPS too if you can, so your provider can't read the lookups on the way. They still won't go through the proxy, but they'll stop passing through your provider's resolver.

Why a leak matters: an example

Picture a proxy in Germany while your lookups go out through your home provider, Comcast, in Florida. The site's own DNS servers note a question from Florida, and a moment later a visit arrives from Germany. Anyone comparing the two can tell a proxy is involved, and roughly where you really are. So test once, fix the leak if there is one, and test again after every browser or system update.