Network

What is DNS Leak?

A DNS leak happens when a client sends its name lookups outside the proxy tunnel, so queries travel over the real ISP connection while the traffic itself exits on the proxy IP. The resolver operator, and any authoritative server it contacts, then sees a lookup tied to your actual network, region and provider.

Leak tests work by handing the browser a set of unique hostnames under a zone the test operator controls, then recording which resolver addresses ask the authoritative server for them. The report lists those resolvers with their networks and countries. That is why a leak test shows resolver identities rather than your own address. The authoritative server never sees you; it sees whoever asked on your behalf. When those resolvers belong to your home ISP while the exit IP belongs to a carrier in another country, the split is plain.

Causes cluster in a few places. A SOCKS5 client configured to resolve names itself hands the proxy an address instead of a hostname. A browser running its own DNS over HTTPS resolver ignores the system configuration you changed. An IPv4-only proxy paired with native IPv6 connectivity sends AAAA traffic around the tunnel. Windows has historically queried every available interface in parallel for speed. Containers and routers push their own hardcoded resolvers, and a split-tunnel VPN rule can exempt port 53 without saying so.

What hurts is usually the contradiction rather than your exact address. Anti-fraud scoring compares the country and network of the exit against everything else the session reveals, and a resolver sitting on a residential line in one country behind an exit in another is a cheap signal to act on. EDNS Client Subnet can push part of your real subnet to authoritative servers as well. Across multiple accounts run from one machine, a shared resolver also links profiles that were meant to look unrelated.

Fixing it means forcing every lookup through the same path as the traffic. Use remote resolution in the SOCKS client, disable the browser's independent DoH resolver or point it at something reachable only through the proxy, and either disable IPv6 or use a dual-stack exit. Then retest inside the stack that does the work. A clean result in a desktop browser proves nothing about a headless Chromium instance or a Python client with different settings, and resolvers rotate, so run the check more than once.

Where you meet it

This comes up right after a proxy setup that looks correct still gets accounts flagged, or when an antidetect profile passes an IP check and fails a fingerprint audit. Run the DNS leak test on proxies.sx from the exact profile and client you use for production work, compare the resolvers it reports against the exit IP's country and network, and fix the mismatch before you scale the run.

Run a DNS leak test

Common questions

How do I test for a DNS leak?

Load a leak-test page through the proxy and compare every resolver it reports against the network and country of your exit IP. Repeat the test a few times, since resolvers rotate between runs, and do it from the same browser profile or client that runs your real workload.

Does a DNS leak expose my real IP address?

Usually it exposes your resolver rather than you. That is often enough, because ISP resolvers map to a provider and a region, and EDNS Client Subnet can forward part of your real subnet. Either way, the result contradicts the location your exit IP claims.

Why does curl leak DNS over SOCKS5?

The socks5:// scheme resolves the hostname locally and then sends the resulting address to the proxy, so the lookup runs on your own connection. Use socks5h:// instead, which passes the hostname to the proxy and lets it resolve from its own network.

Related terms

DNS
The Domain Name System turns a hostname such as example.com into the IP addresses a client can connect to. A stub resolver on the device asks a recursive resolver, which walks the root, TLD and authoritative name servers, then caches the answer for the record's TTL. Queries travel on port 53, or over TLS or HTTPS when encrypted.
WebRTC Leak
A WebRTC leak is a browser exposing your real IP address through its peer-to-peer connection API while page traffic goes through a proxy. WebRTC gathers ICE candidates over its own UDP sockets, which ignore the browser's proxy configuration, and any script on the page can read those candidates without asking permission.
IP Address
An IP address is the numeric identifier a device presents on an IP network so packets can be routed to and from it. IPv4 writes 32 bits as four decimal octets, such as 203.0.113.7. IPv6 writes 128 bits as hexadecimal groups, such as 2001:db8::1. Every request a server logs is tied to one.
IPv4
IPv4 is version 4 of the Internet Protocol, addressing hosts with 32 bits written as four dot-separated octets, which gives roughly 4.3 billion addresses. The top-level pool ran dry in 2011, pushing providers toward private addressing, carrier-grade NAT and a paid transfer market. Nearly all proxy traffic still runs over IPv4 because that is what target sites accept.
IPv6
IPv6 is version 6 of the Internet Protocol, addressing hosts with 128 bits written as eight hexadecimal groups, such as 2001:db8::1. The space is large enough that carriers assign each subscriber a whole subnet, usually a /64 or wider, so reputation systems score prefixes instead of single addresses. Adoption is broad but far from universal.
CGNAT
Carrier-grade NAT is address translation performed by an ISP rather than in the customer's router, putting many subscribers behind one public IPv4 address. Mobile networks depend on it. Each customer holds a private or shared-range address, usually from 100.64.0.0/10, and the carrier rewrites the source address and port on every outbound flow.
NAT
Network Address Translation rewrites the address and port fields of packets as they cross a router, letting many private hosts share one public IP. The router keeps a translation table, mapping each outbound flow to a free public port and reversing the rewrite on replies. Home routers do this for a household; carriers do it for whole regions.
ASN
An Autonomous System Number identifies a network that announces its own IP address ranges to the rest of the internet through BGP. Every routable address sits inside a prefix announced by some AS, so the ASN behind an IP tells you who operates it - a mobile carrier, a hosting provider, a home ISP or a corporate network.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.

View pricing Browse the glossary