How to verify whether your SOCKS-using application is leaking DNS requests over Tor

Even if an application uses Tor's SOCKS proxy, it can still reveal destination hostnames. This article explains how to test your app for DNS leaks using Tor's built-in options and how to block unsafe connections.

Even if your application is using the correct variant of the SOCKS protocol, there is still a risk that it could be leaking DNS queries. This problem happens in Firefox extensions that resolve the destination hostname themselves, for example to show you its IP address, what country it's in, etc. If you suspect your application might behave like this, follow the instructions below to check.

  1. Add TestSocks 1 to your torrc file.
  2. Start Tor, and point your program's SOCKS proxy settings to Tor's SOCKS5 server (socks5://127.0.0.1:9050 by default).
  3. Watch your logs as you use your application. For each socks connection, Tor will log a notice for safe connections, and a warn for connections leaking DNS requests.

If you want to automatically disable all connections leaking DNS requests, set SafeSocks 1 in your torrc file.