DNS leak test before market research

What a DNS leak means for business research

Each time someone on your team opens example.com, a DNS resolver is asked for that site’s IP address before anything else happens. The connection itself, which normally runs through the proxy or VPN, only starts once the answer arrives.

It counts as a leak when the office provider’s resolver answers that question instead of the proxy. Pages still load and nobody notices, yet the provider now holds a list of every domain your team researched, competitors’ sites included. Resolver operators often keep query logs, which can later be requested by authorities, sold on or leaked in a security incident.

Why lookups slip past a proxy

Whether a lookup travels with the proxy depends on the app. If it asks the computer for the site’s address before connecting, the office resolver answers and the proxy only receives a finished IP address. The visit goes through the proxy; the lookup didn’t.

Typical causes in an office setup:

• Desktop tools that use the computer’s DNS - the domain is resolved on the machine itself, and the proxy only ever sees the resulting IP.
• SOCKS4, or SOCKS5 without remote DNS - SOCKS4 cannot carry lookups at all; with SOCKS5 they travel through the proxy only once the app’s “remote DNS” or “proxy DNS” option is enabled.
• Split-tunnel company VPNs - only part of the traffic enters the tunnel, and DNS can end up on the outside.
• Secure DNS inside the browser - Chrome and Firefox both offer DNS over HTTPS, which hands lookups to a provider such as Google or Cloudflare. That option is set separately from the proxy, so confirm where those requests go.

How to keep lookups on the proxy

In the browser

• Firefox: the “Proxy DNS when using SOCKS v5” box sits under Settings → Network Settings; make sure it is ticked.
• Chrome: your IT team can add --proxy-server="socks5://host:port" --host-resolver-rules="MAP * ~NOTFOUND, EXCLUDE proxy" to the shortcut that launches it, or you can use an extension that routes DNS through the proxy.
• Multi-profile browsers (GoLogin, Multilogin, Dolphin Anty) route lookups through the proxy attached to each profile without extra setup, one reason agencies use them for client accounts.

In scripts your team runs

# Python requests + SOCKS5 with DNS-over-proxy
import requests
proxies = {
    'http':  'socks5h://user:pass@host:port',  # 'socks5h' = resolve via proxy
    'https': 'socks5h://user:pass@host:port',
}
requests.get('https://example.com', proxies=proxies)

If a developer set up the tool, ask them to check for socks5h:// rather than socks5://. The h is what hands hostname resolution to the proxy; leave it out and Python resolves every hostname over the office connection.

If a program ignores proxy DNS

A few desktop tools offer no remote DNS setting at all. On those machines, have IT switch the operating system to a public resolver, for example 1.1.1.1 (Cloudflare), 9.9.9.9 (Quad9) or 8.8.8.8 (Google), with DNS-over-HTTPS turned on to encrypt the queries. The lookups still bypass the proxy, but your office provider no longer sees them.

How a leak skews a market check

Say your team in London checks French search results through a proxy in France, but the lookups go through the office provider. The site’s name servers log a request from a British resolver, and moments later a French IP asks for the page, so the two records don’t line up. Some sites also use the lookup’s origin to choose which regional server answers, so the team can end up on the British version of a service. Run the test whenever a browser or laptop is set up for research, and again after browser or operating system updates.