How to avoid DNS leaks? (curl making direct DNS lookups using c-ares)

Author: beelzeCreated Jan 2, 2025Updated Apr 26, 2026

DNS not leaked:

# proxychains wget -q ipinfo.io/ip -O -
[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib64/libproxychains.so.4.17
[proxychains] DLL init: proxychains-ng 4.17
Prepended http:// to 'ipinfo.io/ip'
[proxychains] Strict chain  ...  xx.xx.xx.xx:yy  ...  ipinfo.io:80  ...  OK
94.131.98.223

All is ok, DNS query went through system resolver on proxy server side (checked via tcpdump) but:

# proxychains curl ipinfo.io/ip
[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib64/libproxychains.so.4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] Strict chain  ...  xx.xx.xx.xx:yy  ...  34.117.59.81:80  ...  OK
94.131.98.223

Leaked, DNS query went through localhost system resolver (checked via tcpdump).

proxychains.conf:

strict_chain
proxy_dns_daemon 127.0.0.1:1053
remote_dns_subnet 224      
tcp_read_time_out 15000    
tcp_connect_time_out 8000  
[ProxyList]                                         
socks5 xx.xx.xx.xx yy usr pwd

I encountered this issue trying to find a solution for more generic problem: complete elimination "DNS leak" issue. Of course, it can't be done at localhost, so I'm tunneling all traffic via "router" running tun2socks, but resolving is still a problem – tunneling DNS queries via proxy is a «leak» too. The one and only solution is a delegating resolve to a socks proxy and I'm trying to understang if it can be done with proxychains.

Source: rofl0r/proxychains-ng

View original on GitHub View discussion on GitHub