Skip to content
Get Started
G2G2
4.7/5
Excellent
Trustpilot

What Is a DNS Leak?

A DNS leak happens when your device looks up a website's hostname through your own network's DNS resolver instead of through the proxy. The connection may still use the proxy, but the lookup tells your ISP which sites you visit and can expose your real network.

Try Now for $4.99Continue with Google
  • Session Control
  • High Speed
  • Privacy First
Best fit for DNS leakStatic ISP Proxiesfrom$0.75/IP
how it works

How DNS leaks happen

Before a client can connect to example.com, something has to turn the name into an IP address. With an HTTP proxy, the client sends the hostname to the proxy, in the request line or in the CONNECT request for HTTPS, and the proxy resolves it. Nothing is looked up locally.

SOCKS5 gives the client a choice. It can resolve the name itself and send the proxy an IP address, or send the hostname and let the proxy resolve it. Many tools resolve locally by default. In curl and Python, socks5:// resolves locally and socks5h:// sends the hostname to the proxy.

Leaks also come from outside your scraping code:

DNS leak: key points
  • Browsers using DNS over HTTPS or a system resolver that does not follow the proxy settings.
  • Applications that are not proxy-aware and ignore the system proxy entirely.
  • Proxy setups that cover the browser but not other processes on the same machine.
why it matters

Why DNS leaks matter for proxy users

A leaked lookup goes from your real network to your resolver, so the resolver's operator sees every site you request, and the site's own DNS servers see which resolver asked for their name. A lookup from a resolver in one country followed by a connection from an exit IP in another is a clear sign of an inconsistent setup.

Leaks also hurt geo-targeting. Sites that balance load with DNS answer with servers near your resolver, so you can get content for your own location instead of the proxy's.

try it

Fix it: resolve hostnames on the proxy

With SOCKS5 in Python, use the socks5h:// scheme so no DNS query leaves your machine:

In curl the same switch is -x socks5h://... or --socks5-hostname. The guide to SOCKS5 vs HTTP proxies covers when each protocol fits. CleanProxies static ISP proxies accept HTTP(S) and SOCKS5 with the same username and password, so either way the proxy can resolve hostnames for you.

Remote DNS with Python requestsPython
# pip install "requests[socks]"
import requests

# socks5h:// = the proxy resolves the hostname (no local DNS lookup)
proxies = {
    "http": "socks5h://USER:PASS@PROXY_HOST:PORT",
    "https": "socks5h://USER:PASS@PROXY_HOST:PORT",
}
print(requests.get("https://api.ipify.org", proxies=proxies, timeout=30).text)

Static ISP proxies from $0.75/IP

The CleanProxies proxy that fits best here, with a $4.99 trial to test it first.

Static ISP Proxies

Best fit

Dedicated IPs on US carrier ASNs with unlimited bandwidth and threads, never shared.

starting from$0.75/IP

Dedicated static IPs registered to US and Canadian ISPs. The address stays the same for as long as you hold it, with unlimited bandwidth and HTTP(S) or SOCKS5 access.

Buy NowSee Static ISP Proxies features

Go deeper

Guides from the blog

Setup guides and best practices from the CleanProxies blog.

Get the latest insightsAll Blogs

Related terms

Terms that come up alongside DNS leak.

All glossary terms

DNS leak FAQs

Straight answers about DNS leak.

With socks5 the client resolves the hostname and sends the proxy an IP address. With socks5h the client sends the hostname and the proxy resolves it, so no DNS query leaves your own network.

Got more questions?All FAQs