This guide explains the technical distinction between the two schemes, shows how DNS resolution works with each, and gives setup instructions for clients such as curl, Python requests and browsers. It also covers how to detect and prevent DNS leaks and when remote DNS matters.
SOCKS5 vs SOCKS5h in short
SOCKS5 proxies are widely used for routing network traffic through an intermediary server, often for data collection, market research, or privacy-sensitive tasks. However, many developers overlook a critical detail: where DNS lookups happen. The distinction between SOCKS5 and SOCKS5h (the 'h' stands for 'hostname') determines whether DNS queries are resolved locally on your machine or remotely via the proxy. This affects not just privacy, but also whether your requests appear to come from the correct geographic location.
- SOCKS5 (without 'h'): The client resolves hostnames locally, then sends the resolved IP to the proxy.
- SOCKS5h: The client passes the hostname to the proxy, which resolves it on your behalf (remote DNS resolution).
Understanding and controlling this behavior is essential for:
- Preventing DNS leaks that expose your real IP or network to the target site
- Ensuring that your requests appear to originate from the proxy location, not your own
- Achieving consistent results in geo-targeted testing, public data collection, and privacy-focused work
How SOCKS5 handles DNS
The SOCKS5 protocol itself supports both IP-address and hostname-based connections. However, most proxy clients offer two operational modes:
- Local DNS Resolution (SOCKS5): The client resolves the domain (e.g.,
example.com) to an IP address using your operating system's DNS resolver (your ISP, office network, or local DNS configuration). The client then tells the SOCKS5 proxy to connect to that IP address. As a result, the DNS query is visible to your local network, and the remote proxy only sees the IP.
This is the default behavior for many older clients and some libraries. While it works, it can cause two major issues:
- DNS Leaks: Your local DNS server knows what domains you are accessing, even if the traffic is proxied.
- Location Mismatch: The DNS resolver may return different IPs depending on your local geography. If you're testing geo-targeted content, results may not match what a user in the proxy's location would see.
What SOCKS5h changes: remote DNS
With SOCKS5h, the client sends the hostname (not the resolved IP) to the proxy server. The proxy then performs DNS resolution on its own network, and only then connects to the target server.
This approach offers several advantages:
- No Local DNS Exposure: Your local DNS server never sees the query, eliminating DNS leaks.
- Proxy-Location Consistency: The DNS query is resolved as if it originated from the proxy's location. This is vital for accurate geo-targeted research and public data collection.
- Improved Privacy: The target site and your local network see only the proxy’s information, not your real IP or resolver.
Not all clients support SOCKS5h. Where supported, it is usually invoked by specifying the socks5h:// URI scheme (e.g., in curl) or by enabling a “Proxy DNS through SOCKS5” setting in browsers or extensions.
Why DNS resolution location matters
Privacy and Security
- DNS Leaks: If your DNS queries go through your local resolver, your activity can be logged or monitored by your ISP or network administrator—even if the rest of your traffic is proxied.
- Information Exposure: Some web services use your DNS resolver’s location as a signal for authentication, fraud detection, or access restrictions.
Geo-Targeted Results
- Consistent Testing: If you are using a proxy in a specific country but resolving DNS locally, you may not see the same content or endpoints as a real user in that country. CDN, ad, and content delivery decisions can all be affected by DNS geography.
- Ad Verification & Market Research: For campaigns or data collection that depend on seeing the web “as a local,” remote DNS is essential.
Application Behavior
- Hostname-Based Blocking: Some sites block requests based on the DNS resolver or expect resolution from a certain region. Local DNS can lead to failed requests or misrouting.
How to use socks5h in curl, Python and browsers
Let’s see how this distinction plays out in real-world clients.
curl
curl is a widely used tool for testing and scripting HTTP requests. It supports both socks5:// and socks5h:// schemes.
- Local DNS (default):
curl --proxy socks5://user:pass@proxyhost:port https://example.comHere,example.comwill be resolved locally. If your local DNS resolver is in the US but your proxy is in Germany, the DNS query and CDN routing will reflect your US location. - Remote DNS:
curl --proxy socks5h://user:pass@proxyhost:port https://example.comNow,example.comis resolved by the proxy. The DNS query appears to come from the proxy's network, matching the intended location.
Tip: Always use socks5h:// when location or privacy is critical.
Python Requests
The popular requests library does not natively support SOCKS proxies, but with requests[socks] and PySocks, you can specify a SOCKS5 proxy. However, remote DNS support depends on the underlying PySocks version and implementation.
- Sample Usage:
import requests proxies = { 'http': 'socks5h://user:pass@proxyhost:port', 'https': 'socks5h://user:pass@proxyhost:port' } r = requests.get('https://example.com', proxies=proxies) print(r.text)Withsocks5h://, PySocks will send the hostname to the proxy for remote resolution. Withsocks5://, it may resolve DNS locally (depending on the PySocks version and settings).
Check your library’s documentation and test for DNS leaks to confirm behavior.
Browsers (Firefox, Chrome, Extensions)
Browsers add another layer, as their proxy settings and extensions may handle DNS differently.
- Firefox: Go to
about:preferences>Network Settings. Under “Enable DNS over HTTPS,” you can also find a checkbox for “Proxy DNS when using SOCKS v5.” Enabling this ensures remote DNS when using SOCKS5 proxies. - Chrome: Chrome uses system proxy settings by default and may resolve DNS locally unless configured otherwise. Proxy extensions like FoxyProxy often include an explicit option to “Proxy DNS through SOCKS5.”
Always test with a DNS leak test site after configuration to confirm the DNS path.
SOCKS5 vs SOCKS5h comparison table
| Feature | SOCKS5 | SOCKS5h |
|---|---|---|
| DNS Resolution Location | Local (client-side) | Remote (proxy-side) |
| DNS Leak Risk | Yes | No |
| Geo-Targeting Accuracy | May mismatch | Matches proxy location |
| Privacy | Lower | Higher |
| Client Support | Universal | Only some clients |
| Use Case | Basic proxying | Privacy, geo-testing |
DNS leaks and location mismatches: how to debug
Symptoms of Incorrect DNS Resolution
- DNS Leak: DNS leak test sites show your real ISP or office DNS server, even though requests are proxied.
- Geo Mismatch: Content or endpoints served do not match the proxy’s country or city.
- Hostname Failures: Requests by hostname fail while IP-address requests succeed, indicating a DNS or proxy config issue.
Debugging Steps
- Check Client Settings: Confirm if you are using
socks5://orsocks5h://, and if the client supports remote DNS. - Test with curl: Run with both schemes and compare DNS leak test results.
- Use DNS Leak Test Tools: Visit a DNS leak test site from your browser or script with the proxy enabled.
- Inspect Network Requests: Use Wireshark or tcpdump to confirm where DNS queries are sent.
- Browser Extensions: Ensure extensions or browser settings are configured to proxy DNS.
Best practices for secure proxy use
- Always Use Remote DNS (`SOCKS5h`) for Privacy: Whenever possible, configure your client to resolve DNS through the proxy.
- Test Your Configuration: Run DNS leak tests and verify the location of both the IP and DNS resolver.
- Check Client Documentation: Not all clients support
SOCKS5h. If not, consider switching tools or using additional privacy measures. - Combine with HTTPS: Even with correct DNS, always use HTTPS to protect data in transit.
- Monitor for Changes: Updates to libraries or browser settings can affect DNS behavior. Retest after upgrades.
When remote DNS is not the answer
- Internal Resources: If your workflow requires access to internal or private domains only resolvable on your local network, remote DNS will not work.
- Unsupported Clients: Some legacy or embedded clients do not support remote DNS with SOCKS5h.
- Performance-Sensitive Applications: Remote DNS adds a small latency overhead. For ultra-low-latency needs, weigh this against privacy requirements.
SOCKS5h support at Nefo
Nefo provides robust SOCKS5 proxy support with username/password authentication across residential, datacenter, mobile, and static IP products. For all SOCKS5 endpoints, you can:
- Use
SOCKS5hschemes in supported clients for remote DNS resolution - Geo-target by country or US city via username tokens (on residential proxies)
- Choose between rotating and sticky sessions (up to 24 hours, subject to network availability)
- Rely on secure, authenticated connections—no open proxies
Note: Nefo does not provide DNS-over-HTTPS or custom DNS servers; DNS resolution for SOCKS5h is handled by the proxy's network at the exit location. For full privacy, always verify your application uses remote DNS.
For more details on available proxy types and configuration, see:
Get started with SOCKS5 proxies
- Residential proxies: HTTP, HTTPS and SOCKS5 with geo-targeting, from $0.53/GB, no monthly subscription; bandwidth never expires. SOCKS5 rotating IPs use port 11000 and sticky IPs use port 12000. See residential proxies.
- Mobile proxies: carrier-grade 4G/5G IPs rented per port, from $30 for 30 days, with free location and IP changes. See mobile proxies.
To compare proxy types or get started, visit the pricing page or create an account.
Conclusion
Understanding the difference between SOCKS5 and SOCKS5h is essential for developers and technical teams who care about privacy, geo-targeting, and correct proxy operation. Always prefer remote DNS resolution (SOCKS5h) when privacy or location consistency is required, and test your setup regularly. Nefo supports secure SOCKS5 usage for all proxy types—choose the right configuration for your workflow and enjoy accurate, private, and reliable public data access.
Ready to deploy secure, location-accurate proxies?
View Nefo proxy pricing or sign up now to get started.
Frequently asked questions
With socks5, the client resolves the hostname locally and sends the IP address to the proxy. With socks5h, the client sends the hostname and the proxy resolves it at its exit location.
Local DNS lookups can reveal which sites you visit to your own resolver and may return a different answer from the one a visitor in the proxy's country would get. Remote DNS keeps lookups on the proxy side.
Use the socks5h scheme, for example curl -x socks5h://username:password@host:port https://example.com. The h tells curl to let the proxy resolve the hostname.
Yes. Install requests[socks] and use socks5h:// URLs in the proxies dict. The Python Requests guide shows working code and the Nefo SOCKS5 ports.
Visit a DNS leak test page through the proxy and see whether the resolvers listed belong to your own ISP. If they do, switch to socks5h or set your browser to send DNS through the proxy.
Support varies. Firefox has a setting to proxy DNS when using SOCKS5, while Chrome-based browsers rely on proxy configuration and extensions. Test with a leak check after setup.
Yes. Use socks5h in any client that supports it; DNS is then resolved by the proxy network at the exit location. See SOCKS5 proxies and SOCKS5 vs HTTP proxy.