DNS Leak
A privacy failure where domain name resolution queries travel outside an encrypted VPN or proxy tunnel directly to an ISP's DNS servers, exposing every website you visit.
A DNS leak is a security flaw where a computer connected to a VPN or proxy continues sending its DNS (Domain Name System) queries to its local Internet Service Provider's default DNS servers rather than routing them through the encrypted tunnel.
When a DNS leak occurs, your local ISP, network administrator, or anyone intercepting local Wi-Fi traffic can see the exact domain name of every single website you attempt to visit, even if your actual web payload is encrypted.
How DNS Resolution Works During Normal Browsing (link to this section)
The Domain Name System acts as the address book of the internet. When you type example.com into your browser:
- Your computer cannot route packets to a text name; it needs an IP address (like
93.184.216.34). - Your operating system sends an unencrypted UDP query to a DNS resolver (by default, the DNS server assigned by your local Wi-Fi router or consumer ISP).
- The DNS resolver returns the IP address.
- Your browser then establishes the HTTP/HTTPS connection to that IP.
The Anatomy of a DNS Leak (link to this section)
When you activate a VPN or configure a proxy, the intention is for both the domain resolution and the web traffic to route through the protected tunnel:
- What should happen: Your computer sends the DNS query through the encrypted VPN tunnel to a secure, private DNS resolver operated by the VPN provider.
- What happens during a DNS leak: Due to operating system misconfigurations (particularly in Windows), the OS bypasses the virtual network adapter and sends DNS queries directly through your physical Wi-Fi or Ethernet adapter to your local ISP's DNS servers.
Windows Smart Multi-Homed Name Resolution: The Main Culprit (link to this section)
On Windows operating systems (Windows 8, 10, and 11), a built-in networking feature called Smart Multi-Homed Name Resolution (SMHNR) sends DNS queries across all available network adapters simultaneously to achieve the fastest response:
- Even when connected to a VPN, Windows sends queries to both your VPN DNS and your local ISP DNS.
- Whichever server responds first is used.
- As a direct result, your local ISP logs every query, creating a persistent DNS leak.
How DNS Leaks Impact Web Scrapers & Proxy Users (link to this section)
In web scraping and multi-accounting, DNS leaks cause severe operational problems:
- Proxy vs DNS Location Mismatch: Anti-bot engines (Cloudflare, Akamai) inspect the geographic location of your DNS resolver. If your proxy IP is in Tokyo, Japan, but your DNS queries resolve through a Comcast server in Chicago, fraud systems flag the connection as an automated proxy.
- Local Resolution with
socks5://: When using SOCKS5 proxies in Python or cURL, usingsocks5://causes the local machine to resolve the domain before connecting. Always usesocks5h://to force the proxy to resolve the hostname remotely.
How to Fix and Prevent DNS Leaks (link to this section)
- Enable DNS Leak Protection in VPNs: High-tier VPNs force all DNS traffic through their encrypted virtual adapter and block non-VPN DNS requests at the Windows Filtering Platform (WFP) firewall level.
- Use Encrypted DNS (DoH / DoT): Configure DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) in your browser or operating system using privacy resolvers like Cloudflare (
1.1.1.1) or Quad9 (9.9.9.9). - Use Remote DNS in Proxy Clients: Always configure proxy URLs using remote DNS protocols (
socks5h://or standard HTTP CONNECT).
In practice
- A user connected to a VPN server in Sweden visits an e-commerce site; their local ISP in the United Kingdom still logs every domain visited due to an unencrypted DNS leak.
- A web scraper getting blocked by Cloudflare because the scraper's SOCKS5 proxy was in Germany, but Python resolved the hostnames locally using an AWS US-East DNS resolver.
- Running ProxyRaw's leak detection tool to verify that all DNS requests originate from the VPN provider's proprietary zero-log resolvers.
- Configuring DNS-over-HTTPS (DoH) in Google Chrome to ensure all domain queries are encrypted regardless of network adapter state.
Common use cases
Frequently asked
With `socks5://`, your local computer resolves the domain name locally using your home ISP's DNS before sending the IP to the proxy. With `socks5h://`, the hostname is sent directly to the proxy to be resolved remotely, completely eliminating DNS leaks.
No. Your ISP can only see the root domain name (e.g., `reddit.com`), not the specific page, URL path, or content (e.g., `/r/privacy`), because the subsequent HTTPS connection remains encrypted.
Windows sends DNS queries across all active network adapters at once to get the fastest response. Even when a VPN is connected, queries are sent simultaneously to your local ISP's DNS server.
Ensure your VPN app has 'DNS Leak Protection' enabled, configure DNS-over-HTTPS (DoH) in your browser settings, or manually set your network adapter's DNS to a privacy-focused resolver like 1.1.1.1.