GlossaryNetworkingBeginner

DNS (Domain Name System)

DNS is the internet's address book: it turns a name like example.com into the numeric IP address a computer needs before it can open a connection — and it quietly reveals every site you visit while doing so.

Last updated August 14, 2026

Definition

The Domain Name System (DNS) converts a name a person can remember, such as proxyhorizon.com, into the numeric IP address a computer actually needs to open a connection. Nothing you do online happens without it happening first.

The order of events is worth being precise about. Your browser does not "visit a domain". It asks DNS for an address, receives one, then connects to that address. The domain name is a label; the IP is the destination.

What happens during a lookup

  1. Recursive resolver — usually run by your ISP, or a public service you have chosen. It does the legwork on your behalf.
  2. Root servers — they do not know the answer, but they know which servers handle .com.
  3. TLD servers — these know which nameservers are authoritative for the domain.
  4. Authoritative nameserver — the final word, holding the actual records.

In practice most of these steps are skipped, because every answer carries a TTL telling everyone how long they may cache it. That is why a DNS change reaches one visitor in minutes and another in hours: they are holding cached answers of different ages.

The records you will actually meet

  • A — maps a name to an IPv4 address.
  • AAAA — the same for an IPv6 address.
  • CNAME — points one name at another, commonly to hand traffic to a CDN.
  • MX — where to deliver email for the domain.
  • TXT — free-form text, used for domain verification and email authentication.
  • NS — which nameservers are authoritative.

Your resolver sees everything

DNS was designed in 1983 without encryption, so a plain lookup travels in clear text and names every domain you request. HTTPS protects the contents of the page, but the lookup that preceded it already announced where you were going.

Encrypted DNS — DoH (over HTTPS) and DoT (over TLS) — hides queries from anyone sitting between you and your resolver. Changing resolver to 1.1.1.1 or 8.8.8.8 moves the log rather than removing it: you are choosing who to trust with your browsing history, not hiding it from everyone.

DNS and proxies: the leak problem

A DNS leak is when your traffic goes through a VPN or proxy but your lookups do not — the tunnel carries your data while your ISP's resolver quietly logs every domain you asked for.

  • HTTP proxies generally receive the full hostname and resolve it themselves, which is safe.
  • SOCKS5 can go either way. In curl this is the difference between socks5://, which resolves on your machine and leaks, and socks5h://, which lets the proxy resolve. One character decides it.
  • Browsers with their own DoH setting may bypass both, resolving independently of your system and your tunnel.

DNS decides which version of a site you see

Large sites return different addresses depending on where the query appears to come from, steering you to the nearest CDN edge. Good for speed — but a mismatch between your proxy's location and your resolver's location will serve you the wrong region's content, a common and genuinely confusing failure in geo-targeted testing. If your proxy exits in Berlin, your DNS should resolve from Berlin too.

Examples

1

Resolving example.com to 93.184.216.34 before a single byte of the page is requested

2

Switching a router from the ISP resolver to 1.1.1.1 or 8.8.8.8

3

Using socks5h:// instead of socks5:// in curl so the proxy resolves the hostname and nothing leaks

4

A 300-second TTL meaning a DNS change reaches most visitors within five minutes

5

A CNAME pointing shop.example.com at a CDN hostname that returns a different IP in every region

Common Use Cases

Translating domain names into IP addresses for every connection you make
Routing visitors to their nearest CDN edge server
Verifying domain ownership and email authentication through TXT records
Diagnosing DNS leaks when auditing a VPN or proxy setup
Failing traffic over to a backup server by changing an A record
Blocking ads and trackers at the network level with a filtering resolver

Frequently Asked Questions

It is when your traffic travels through a VPN or proxy but your DNS lookups escape it, going to your ISP's resolver instead. Your data stays encrypted while a full list of the domains you visited is handed to the party you were trying to avoid.
A good one does, by routing lookups through its own resolvers inside the tunnel. Not all do, and some browsers resolve independently of the system. Running a DNS leak test after connecting is the only way to be sure.
It moves the log rather than deleting it. You stop your ISP seeing your lookups and start Cloudflare or Google seeing them. The real gain comes from pairing a resolver you trust with encrypted DNS so nobody in between can read the queries.
Both encrypt DNS. DoT uses a dedicated port, which makes it easy for a network to identify and block. DoH sends queries over normal HTTPS traffic, which makes it much harder to single out but also harder for administrators to manage.
Because of caching. Every record carries a TTL saying how long resolvers may hold it, so visitors keep seeing the old answer until their cached copy expires. Lowering the TTL before a planned change shortens the wait.
Yes, and it catches people out. Sites use DNS to route you to a regional server, so if your proxy exits in one country while your resolver sits in another, you can get content for the wrong region even though the proxy is working correctly.
An HTTP proxy usually does, since it receives the hostname and resolves it itself. SOCKS5 depends on configuration — remote resolution is safe, local resolution leaks. Check which mode your client is using rather than assuming.

Keep Learning

All terms

IPv4

IPv4 is the 32-bit addressing system most of the internet still runs on, giving every device a number like 203.0.113.42. Its roughly 4.3 billion addresses ran out years ago, which is why clean IPv4 is scarce and expensive.

Read definition

VPN

A VPN (Virtual Private Network) encrypts all of your device's internet traffic and routes it through a remote server, hiding your IP and protecting data on untrusted networks.

Read definition

WebRTC Leak

A WebRTC leak exposes your real IP address through the browser's built-in real-time communication feature — even when you are using a VPN or proxy.

Read definition

CDN (Content Delivery Network)

A CDN is a network of servers spread across the globe that stores copies of website content close to users for faster loading. It also protects sites by absorbing traffic spikes and filtering malicious requests.

Read definition

HTTPS

HTTPS is the secure version of HTTP that encrypts data between your browser and a website using SSL/TLS. It prevents eavesdroppers from reading or tampering with the traffic.

Read definition

DNS Leak

A DNS leak happens when your device sends domain lookups outside the VPN tunnel, so your ISP can still see every site you visit even though the traffic itself is encrypted.

Read definition
Back to Glossary