This is the quietest mistake a proxy user makes: the IP address has changed, the traffic goes through the proxy — but the information about which site you are visiting leaks out of your local network. The reason is where DNS resolution is performed.
SOCKS5 offers a clear choice here, and that choice comes down to a single letter: socks5 online? socks5h ?
Two Different Paths
socks5 in your configuration means the client resolves the domain name itself and hands the proxy a ready IP. That means every site you visit ends up in the local DNS records.
How Does the Leak Happen?
When resolution is done locally, the DNS query goes to one of these places:
- To your internet service provider's resolver — which sites you visit is recorded.
- To the corporate network's DNS server — the network administrator sees your traffic.
- To a public resolver — the query is made from your real IP.
In all three cases, part of the privacy the proxy provides is wasted. For more on the types of leaks see our is a proxy safe article, and for testing our DNS leak test tool.
The Correct Configuration
The h letter in the scheme stands for "hostname". This one-letter difference is the line between a leak and privacy.
The defaults are not safe. In many libraries, writing socks5:// performs local resolution. When writing your configuration, deliberately choose socks5h .
The Situation in Browsers
Browsers may resolve DNS locally by default when using SOCKS5. Firefox has an explicit setting that changes this:
| Browser | Setting | Result |
|---|---|---|
| Firefox | network.proxy.socks_remote_dns → true | DNS is resolved on the proxy side |
| Chrome | Uses the system proxy setting | Behavior depends on the platform |
| Chrome (flag) | --proxy-server="socks5://..." | Generally performs remote resolution |
You can reach the Firefox setting via about:config . For browser-specific details, see Firefox proxy settings article for details.
What About HTTP Proxies?
With an HTTP proxy this problem generally does not exist: because the full URL or the CONNECT target is sent as a domain name in the request line, the proxy performs the resolution. This means that, in terms of DNS, an HTTP proxy is safer by default.
SOCKS5 is more flexible but requires more care. That flexibility brings a responsibility: choosing the right scheme is up to you.
Verification
Test that your configuration really performs remote resolution:
You can run the leak test from our DNS leak test page , and check your exit IP with My IP Address .
Summary
In SOCKS5, where DNS resolution is performed is the client's choice, and the default is usually unsafe. Using the socks5h scheme prevents domain name information from leaking out of your local network. In this respect an HTTP proxy is safer by default. After writing your configuration, always verify it with a leak test — a single missing letter can largely defeat the purpose of using a proxy.