DEFGlossary · Security & Privacy

DNS Leak: Definition & How It Works

Definition

A DNS leak occurs when your DNS queries are sent directly to your ISP DNS resolver instead of through your proxy or VPN tunnel. This reveals which domains you visit, even though your HTTP traffic is proxied.

How DNS Leak works

When you use a proxy, your HTTP requests go through the proxy, but DNS resolution may still happen locally on your device using your ISP DNS server. The ISP then sees every domain name you look up, creating a log of your browsing activity. This happens because many proxy configurations only handle HTTP traffic, not the DNS queries that precede each connection.

Your clientoriginates the request

→

Encrypted tunnelthrough the proxy gateway

→

Destination serversees the proxy IP only

The target only ever sees the gateway -- never your real IP.

Applying DNS Leak

Match the strength of this control to what is actually at risk in the workflow.

Worth applying when

Protecting a real IP address or identity while browsing
Handling logins, accounts, or payment-adjacent flows
Meeting a client or compliance requirement
Keeping two sessions from being linked back to each other

Lower priority when

The data involved is fully public and non-sensitive
The workflow already runs on a trusted, private network
Extra hops would add latency for no real benefit
Dedicated infrastructure already covers it

Putting DNS Leak into practice

proxy credentials

USER-country-de-session-task01

The credential string is the only configuration needed -- "country-de" sets the exit, "session-task01" keeps it consistent, and dns leak is handled by the gateway rather than your application code.

Confirm it, do not assume it

Test the setup with a leak-test tool or packet capture to confirm this protection is actually working, not just configured.

One layer, not the whole stack

Pair this with sane session handling and header hygiene -- no single control covers a full workflow on its own.

Match it to what is sensitive

Apply the strongest version of this control to logins, payments, and personal data -- it is overkill for public information.

Keep identities separate

Do not let two workflows that need to stay separate for privacy or account reasons share the same session or IP.

Practical example

A researcher routes all web traffic through a SOCKS5 proxy but forgets to enable remote DNS resolution, so their ISP still sees every domain they look up.

Why it matters

A DNS leak exposes your browsing activity to your ISP and local network, even when using a proxy. It defeats the purpose of using a proxy for privacy.

How DNS Leak applies to proxy workflows

DNS Leak protects the identity or data flowing through a proxy connection. The level of protection you need depends on what is at stake in the workflow.

Proxies already separate your real IP from the target, but this adds a second layer of assurance on top.
It matters most for workflows involving accounts, logins, or any data that links back to a real identity.
For public data collection with no account involvement, the proxy itself usually provides enough separation.

How do I test for DNS leaks?

Use a DNS leak test tool that checks which DNS servers actually handle your queries in real time. If the results show your ISP's DNS server instead of the proxy provider's DNS, you have a leak. Run this test before starting any privacy-sensitive or geo-targeted work.

How do I fix DNS leaks with SOCKS5 proxies?

Enable remote DNS resolution in your SOCKS5 client configuration so lookups travel through the tunnel instead of your local network. In most libraries, a flag sends DNS queries through the SOCKS5 connection. For browsers, confirm DNS over SOCKS is turned on in the network settings before testing.

RELSee also

Networking

DNS

DNS (Domain Name System) is the protocol that translates human-readable domain names (like example.com) into IP addresses (like 93.184.216.34) that computers use to route traffic. It functions as the internet phone book.

Security & Privacy

WebRTC Leak

A WebRTC leak occurs when the WebRTC protocol in your browser exposes your real IP address to websites, even when you are connected through a proxy or VPN. It bypasses proxy settings by making direct peer-to-peer connections.

Proxy Types

SOCKS5 Proxy

SOCKS5 is a proxy protocol that routes any type of network traffic (TCP and UDP) without modifying the data packets. It operates at a lower level than HTTP proxies, supporting protocols beyond just web browsing.

Security & Privacy

VPN vs Proxy

A VPN (Virtual Private Network) encrypts and routes all traffic from a device through a secure tunnel, while a proxy routes traffic at the application level without necessarily encrypting it. They serve different purposes despite both changing your visible IP address.

Security & Privacy

Encryption

Encryption is the process of converting readable data (plaintext) into an unreadable format (ciphertext) using a mathematical algorithm and a key. Only authorized parties with the correct key can decrypt and read the data.

Networking

DNS over HTTPS

DNS over HTTPS, often shortened to DoH, is a method of performing DNS lookups through an encrypted HTTPS connection instead of sending them in plain text. It hides which domains a device is looking up from anyone monitoring the network.

Full glossary -- 159 terms

In practice

Ready to put this into practice? DNS Leak Test

See it in action

Test with real targets -- instant activation, no sales call, 14-day money-back guarantee.

Get Started Browse glossary