Network

What is DNS?

The Domain Name System turns a hostname such as example.com into the IP addresses a client can connect to. A stub resolver on the device asks a recursive resolver, which walks the root, TLD and authoritative name servers, then caches the answer for the record's TTL. Queries travel on port 53, or over TLS or HTTPS when encrypted.

The lookup is a delegation chain. A recursive resolver asks a root server which name servers handle .com, asks those which servers are authoritative for example.com, then asks the authoritative server for the record. Each answer carries a TTL, and the resolver serves that answer from cache until it expires, which is why a record change takes time to reach everyone. Queries normally ride UDP on port 53. When a response is too large the server sets the truncated bit and the client repeats the query over TCP, unless EDNS0 has negotiated a larger UDP payload.

Clients ask for record types rather than for a generic answer. A is an IPv4 address, AAAA an IPv6 address, CNAME an alias to another name, MX a mail route, TXT arbitrary text used for domain verification and mail policy. A browser opening a page usually requests A and AAAA together and races connections to whichever family answers first. Failed lookups get cached too, so a domain that briefly returned NXDOMAIN can keep failing on a machine after the zone is fixed.

Who performs the lookup changes when a proxy is in the path. An HTTP proxy receives the hostname in the request line or in a CONNECT, so it resolves the name from its own network. SOCKS5 can carry a domain name in the address field, but only when the client asks for that. curl treats socks5:// as resolve locally and socks5h:// as hand the hostname to the proxy, and Firefox keeps a separate preference for remote SOCKS DNS. Get it wrong and the connection still works while the lookup runs on your real link.

Encrypted transports moved the query off plaintext port 53. DNS over TLS runs on port 853, and DNS over HTTPS rides ordinary HTTPS on 443 against a resolver endpoint, which makes it indistinguishable from other web traffic on the wire. Browsers ship their own DoH resolvers and can bypass the operating system's configuration entirely. EDNS Client Subnet complicates things further. A resolver may pass a truncated form of the client subnet to authoritative servers so CDNs answer with a nearby edge, which ties CDN routing to the resolver's network rather than to the exit IP.

Where you meet it

DNS shows up the moment a scraper works from a proxy but pulls content from the wrong region, or a request that succeeds against an IP address fails against a hostname. It also appears in containers, where a baked-in resolver quietly overrides everything you configured. Before blaming the proxy, work out which component performed the lookup and on which network it ran.

Run a DNS leak test

Common questions

Does my proxy resolve DNS for me?

An HTTP proxy always does, because it receives the hostname rather than an address. SOCKS5 can, but only if the client asks it to - curl's socks5h scheme, or the remote-DNS option in a browser or library. Otherwise the operating system resolver handles the name on your real connection.

What port does DNS use?

Port 53 over UDP for ordinary queries, with the same port over TCP for large responses, zone transfers and retries after a truncated answer. DNS over TLS uses port 853, while DNS over HTTPS travels on 443 alongside normal web traffic, which is part of why a network operator cannot filter it selectively.

Why does content load from the wrong country through my proxy?

CDNs choose an edge based on the resolver that asked, not on the client that connects. If your resolver sits in a different country from the exit IP, you get an edge near the resolver. Force resolution through the proxy, or use a resolver on the same network as the exit.

Related terms

DNS Leak
A DNS leak happens when a client sends its name lookups outside the proxy tunnel, so queries travel over the real ISP connection while the traffic itself exits on the proxy IP. The resolver operator, and any authoritative server it contacts, then sees a lookup tied to your actual network, region and provider.
IP Address
An IP address is the numeric identifier a device presents on an IP network so packets can be routed to and from it. IPv4 writes 32 bits as four decimal octets, such as 203.0.113.7. IPv6 writes 128 bits as hexadecimal groups, such as 2001:db8::1. Every request a server logs is tied to one.
IPv4
IPv4 is version 4 of the Internet Protocol, addressing hosts with 32 bits written as four dot-separated octets, which gives roughly 4.3 billion addresses. The top-level pool ran dry in 2011, pushing providers toward private addressing, carrier-grade NAT and a paid transfer market. Nearly all proxy traffic still runs over IPv4 because that is what target sites accept.
IPv6
IPv6 is version 6 of the Internet Protocol, addressing hosts with 128 bits written as eight hexadecimal groups, such as 2001:db8::1. The space is large enough that carriers assign each subscriber a whole subnet, usually a /64 or wider, so reputation systems score prefixes instead of single addresses. Adoption is broad but far from universal.
CGNAT
Carrier-grade NAT is address translation performed by an ISP rather than in the customer's router, putting many subscribers behind one public IPv4 address. Mobile networks depend on it. Each customer holds a private or shared-range address, usually from 100.64.0.0/10, and the carrier rewrites the source address and port on every outbound flow.
NAT
Network Address Translation rewrites the address and port fields of packets as they cross a router, letting many private hosts share one public IP. The router keeps a translation table, mapping each outbound flow to a free public port and reversing the rewrite on replies. Home routers do this for a household; carriers do it for whole regions.
ASN
An Autonomous System Number identifies a network that announces its own IP address ranges to the rest of the internet through BGP. Every routable address sits inside a prefix announced by some AS, so the ASN behind an IP tells you who operates it - a mobile carrier, a hosting provider, a home ISP or a corporate network.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.

View pricing Browse the glossary