Glossary · Networking
DNS leak
A DNS leak is when a client sends its traffic through a proxy or VPN but resolves hostnames through its own local resolver, so the lookups leave from the original network — exposing which sites you visit to that resolver and, for location-dependent services, possibly connecting you to a server picked for the wrong place.
Reviewed 30 Oct 2026
# Leaks: curl resolves example.com itself, then sends an IP to the proxycurl -x "socks5://USERNAME_pool-arcfast_country-de:PASSWORD@proxy.arcproxies.io:8000" https://example.com/# Does not leak: the hostname is resolved at the exitcurl -x "socks5h://USERNAME_pool-arcfast_country-de:PASSWORD@proxy.arcproxies.io:8000" https://example.com/How a leak happens with proxies
| Setup | Who resolves the hostname | Leak? |
|---|---|---|
| HTTP proxy, HTTPS via CONNECT | The proxy — the client sends host:port | No |
| HTTP proxy, plain HTTP | The proxy — the client sends the full URL | No |
socks5h:// | The proxy — SOCKS5 can carry a domain name (RFC 1928) | No |
socks5:// | Your machine, which then sends an IP | Yes |
| Tool that resolves first, then connects to an IP | Your machine | Yes |
The difference between the two SOCKS schemes is covered under SOCKS5.
Why it skews geo-targeted collection
Many large sites answer DNS differently depending on where the query comes from and send you to a nearby server. RFC 7871 describes authoritative servers that tailor responses to the querier's location. If the lookup happens at your office and the request leaves from a German exit, the exit can be sent to a server chosen for your office — and the page may differ from what a local visitor gets. That undermines geo-targeting without any visible error.
How to check and prevent it
- Prefer an HTTP proxy URL or
socks5h://so the hostname travels to the exit. - Watch outgoing DNS on your machine (for example with a packet capture on port 53) while a job runs; lookups for target hosts mean a leak.
- Compare the page you collect with a known local version, as in test proxy location.
- In browsers, also check WebRTC, which can expose local addresses separately from DNS.
FAQ
Questions
Something not covered? Write to contact@arcproxies.io.
Do HTTP proxies leak DNS?
Not in normal use. With an HTTP proxy the client hands the hostname to the proxy, in the CONNECT request for HTTPS or in the full URL for plain HTTP, and the proxy resolves it. Leaks come from SOCKS used without remote resolution or from tools that resolve before connecting.
Is a DNS leak a security problem?
Mainly a privacy one: your resolver, often your ISP's, sees the names of the sites you reach even though the traffic goes elsewhere. For data collection the bigger problem is accuracy, because location-aware DNS can route the exit to the wrong server.
Can a DNS leak change the prices I collect?
It can, where a site serves different content from different servers by region. If DNS is resolved near you rather than near the exit, the exit may receive the version meant for your region.
How do I stop DNS leaks in Python requests?
Use an http:// proxy URL, or socks5h:// rather than socks5:// when using SOCKS. Both make the proxy resolve the hostname at the exit.
Sources & review
Last reviewed by the ARC Proxies team. Prices are read from the live catalog at build time.
- [1]IETF: RFC 1928: SOCKS Protocol Version 5
- [2]IETF: RFC 7871: Client Subnet in DNS Queries
In practice