How a DNS leak happens
Before connecting to example.com, a client uses DNS to find the server’s IP address. A leak occurs when this lookup follows your ordinary network connection while the web request uses a proxy or VPN.
An HTTP proxy usually receives the hostname and resolves it. A SOCKS client may resolve locally or ask the proxy, depending on its settings. Browser DNS prefetch, direct DNS-over-HTTPS and split tunneling can also create a separate path.
Why DNS leaks matter with proxies
A request can leave through proxy exit 203.0.113.20 while its DNS query leaves through your original connection. The DNS resolver can see the requested domain and your source IP address, though it can’t see the full path or encrypted HTTPS content.
The target website usually sees the proxy IP, not the DNS query. However, a site that controls its authoritative DNS can create unique hostnames and compare resolver information and timing with the web request. A mismatch may become one bot detection signal. It doesn’t mean the proxied request itself bypassed the proxy.
How to find and stop a DNS leak
- Test the same app you use with the proxy. Note the proxy exit IP and the DNS resolvers reported by a browser-based leak test.
- Check the resolver owner. A resolver belonging to your local ISP is suspicious. A public resolver in another region isn’t proof by itself because routing and anycast affect its apparent location.
- Enable remote resolution. Select “proxy DNS” or a similar setting. With a SOCKS5 proxy, send the hostname to the proxy instead of resolving it locally.
- Cover every network route. If all traffic must use one path, configure a full-tunnel VPN and disable split tunneling or direct DNS fallback.
- Retest after changes. Review browser Secure DNS, prefetch and extension settings, clear cached DNS entries and test both IPv4 and IPv6.
DNS leaks vs WebRTC leaks
A WebRTC leak comes from browser media networking rather than hostname resolution.
| DNS leak | WebRTC leak | |
|---|---|---|
| Mechanism | Domain lookup takes another path | Browser gathers connection candidates |
| Observed by | DNS resolver or network operator | Page scripts and related servers |
| Possible exposure | Domains and source network | Local or public IP candidates |
FAQ
Does a DNS leak show my real IP to a website?
Usually not. The DNS resolver sees your source IP, while the website normally sees the proxy exit IP. A website controlling its DNS may still infer network inconsistencies from resolver data.
Does HTTPS prevent DNS leaks?
No. HTTPS encrypts web traffic after name resolution. DNS-over-HTTPS encrypts the lookup, but a direct connection to the resolver can still bypass your intended proxy or tunnel.
Can a DNS leak happen even if my proxy is working?
Yes. Your HTTP requests can use the proxy while DNS lookups use the ordinary network connection. Proxy routing and DNS routing are separate settings in many clients.