DNS
DNS is the system that turns a site name, such as example.com, into the IP address of a server.
Updated · Prokso editorial team
Before opening a website, a program asks a DNS server which address is behind the name. Only then does it connect to that address.
When working through a proxy, it matters who makes this request. If your device makes it, your ISP sees the site names, and the site may resolve to a different address than for the proxy's country. This is called a DNS leak.
With an HTTP proxy the site name is usually passed to the proxy, and the proxy resolves the address. For SOCKS5 this is a separate setting in many programs, for example the socks5h scheme in curl and Python.
DNS responses are cached, so a change in a site's address does not reach users right away.
Which DNS records a program asks for
A name can have several types of records, and a program asks for the ones it needs. For a connection to a site, the records with the IPv4 and IPv6 address matter, as well as an alias that points to another name. Each answer comes with a lifetime, after which the record is requested again.
| Record | What it holds |
|---|---|
A | IPv4 address |
AAAA | IPv6 address |
CNAME | alias of another name |
TTL | how many seconds the answer may be cached |
Large sites often return different A records in different countries, closer to the visitor. That is why it matters on which side the name is resolved: on the proxy side, the site gets an address that suits the proxy's country.
DNS traffic through Prokso
Classic DNS requests travel over UDP to port 53, and Prokso does not pass UDP. So a program that sends its own DNS requests "through the proxy" over UDP will not get an answer. Over TCP, ports 53 and 853 are on the list of open ports; port 853 is used by DNS over TLS.
In everyday work this is rarely needed: with an HTTP proxy and with the socks5h scheme, the gateway resolves the site name itself. For encrypted lookups in the browser, see the article on DNS over HTTPS, which works over port 443.
How to look at the records yourself
The command nslookup example.com works on Windows, macOS and Linux and shows the addresses behind the name. On macOS and Linux, dig example.com AAAA shows a specific record type and its TTL. If a site has moved and you still land on the old address, check the hosts file: an entry there takes priority over DNS.
FAQ
What is socks5h?
It is a protocol notation in curl and Python where the site name is passed to the proxy, and the proxy resolves the address. With socks5 without the h, your device resolves the name.
Does the proxy see which sites I open?
Yes, the proxy always sees the site name, because it has to connect to it. The contents of HTTPS pages remain encrypted.
Related terms
Residential $1.59, mobile $2.50, datacenter $0.65 per GB
Sign up in a minute, get access right after payment.