Detection & trust · glossary

DNS leak

A DNS leak happens when a client resolves destination hostnames through its own resolver instead of through the proxy, so the local network or ISP learns which sites are visited even though the requests themselves travel through the exit. With HTTP proxies the hostname is sent to the proxy and no leak occurs; with SOCKS5 it depends on whether the client sends the name (socks5h) or resolves it first (socks5).

1 min read Updated

Protocols All terms

Where it bites#

  • SOCKS5 clients configured with socks5:// rather than socks5h://.
  • Browsers with system DNS or DNS-over-HTTPS enabled that bypass the proxy for lookups.
  • Scripts that resolve once locally and then connect to an IP through the proxy: correct destination, leaked lookup, and a possibly wrong CDN edge.

Why it also changes results#

Geo-aware DNS answers differently per region. Resolving locally then connecting through a foreign exit reaches the wrong regional edge, which can serve the wrong prices or language. Resolving at the exit is both private and correct.

How it works at ProxShift#

ProxShift resolves hostnames at the exit for HTTP(S) and for SOCKS5 connections that pass a hostname; the code examples use socks5h where the client distinguishes it.

Ready when you are

See it on a real request.

Create an account, top up $20 and run the quickstart against your own target. Traffic you buy never expires.

Create an account Read the quickstart