What Is a DNS Leak and How to Fix It with a Proxy
Updated:
A DNS leak happens when your device asks your own provider's DNS server to translate domain names into IP addresses while your web traffic goes through a proxy. Websites and intermediaries can then see a lookup from your home network next to a connection from, say, a US IP, which is an easy mismatch to spot. With an HTTP proxy configured correctly in a browser, the proxy usually resolves domains, so leaks are uncommon. They tend to appear with apps that bypass the proxy, tools that resolve names before connecting, or incomplete system settings. This guide explains the mechanism, how to test for it and how to fix each case.
What DNS is and how it can leak
Every time you open a site, your device needs the IP behind the domain name. That lookup is done by a DNS resolver, usually your provider's or a public DNS service you configured.
The resolver sees which domains you look up, and the website's DNS server sees which resolver is asking. If you connect through a proxy in another country but DNS still goes through your home provider, the two pieces of information disagree. That is a DNS leak.
How HTTP proxies handle DNS
When a browser uses an HTTP/HTTPS proxy, it sends the full hostname, for example CONNECT example.com:443. The proxy server resolves the name and opens the connection, so for proxied requests your device does not need to ask your provider's DNS.
This differs from a VPN, which tunnels all traffic and needs DNS configured separately; see proxy vs VPN. It also differs from setups where a tool resolves names locally and only hands the proxy an IP address.
| Situation | Who resolves DNS | Leak risk |
|---|---|---|
| Browser with a correctly set HTTP proxy | Proxy server | Low |
| App ignoring system proxy settings | Your provider | High, the traffic bypasses the proxy too |
| Script resolves the IP, then connects via proxy | Your provider | Medium |
| Proxifier with remote name resolution | Proxy server | Low |
| VPN without DNS configured | Your provider | High |
How to test for a DNS leak
- Step 1, confirm the IP: open What is my IP in the browser or profile you use and make sure it shows the proxy IP.
- Step 2, run a DNS test on a site such as dnsleaktest.com or the DNS section of browserleaks.com, using the extended test.
- Step 3, read the resolver list: the page lists the DNS servers that queried on your behalf, with organisation and country.
- Step 4, compare: if your home provider's resolver appears, you have a leak. If you only see resolvers tied to the proxy side or a large public DNS service, there is usually no leak.
- Step 5, check apps too: for non-browser apps, first confirm the app uses the proxy at all. See proxy works in the browser but not in an app.
A resolver in another country is not always a leak
People often worry when a Japanese proxy shows a resolver in Singapore or a public DNS provider. The proxy server has to use some resolver too, and it may be elsewhere or a global anycast service. That is a property of the proxy's infrastructure, not data leaking from your device.
The real sign of a leak is your own home or office provider's resolver in the list. It means at least some lookups go straight from your device, outside the proxy.
How to fix a DNS leak
- Set the proxy inside the browser or antidetect profile instead of relying on system settings. Our setup guides cover each tool, such as Chrome and Firefox.
- For apps without proxy support, use Proxifier and enable resolving hostnames through the proxy under Name Resolution.
- In code, pass the hostname to the proxy instead of resolving it first.
curl -x http://user:pass@ip:port https://example.comlets the proxy resolve it. - Disable extensions or software that change DNS if you do not need them.
- Retest after every change with a DNS test and the WebRTC leak test, since WebRTC exposes IPs more often than DNS does.
Does a DNS leak matter for you?
For country-specific search checks or public data collection, a DNS leak rarely changes results because sites mainly look at the connecting IP. For accounts that stay logged in long term, remove every mismatch you can control, DNS included. The full list of signals is in how websites detect proxies.
Remember that a proxy adds no extra encryption and is not a security tool. It connects you from the right country with a fixed IP; everything else still needs correct configuration.
Frequently asked questions
Do HTTP proxies leak DNS?
With a correctly configured browser, the proxy resolves domains, so leaks are uncommon. They usually come from apps that bypass the proxy or scripts that resolve names first.
The test shows a resolver in a different country from my proxy. Is that bad?
Usually not. It is the resolver the proxy server uses. Only your own provider's resolver is a sign of a leak.
How is a DNS leak different from a WebRTC leak?
A DNS leak reveals that lookups go through your provider. A WebRTC leak exposes your real IP directly through the browser's UDP connections and is usually more serious.
Does switching to public DNS stop the leak?
Not really. If lookups still come from your device, the public resolver still sees your real IP. Let the proxy side resolve domains instead.
Does a proxy encrypt DNS?
A proxy adds no encryption of its own. HTTPS content is still encrypted by the website, and name resolution happens on the proxy server.
Dedicated proxies with a fixed IP per country
HTTP/HTTPS with username and password, delivered as ip:port:user:pass. Private IPv4 in seven countries, static ISP in Vietnam and the US.
View pricing