SOCKS5 vs SOCKS5h: where does DNS resolve?

Compare socks5 and socks5h by client

The curl manual documents local resolution for --socks5 and proxy-side resolution for --socks5-hostname. Requests documents the same split for socks5 and socks5h URLs and needs its optional SOCKS extra installed.

See the difference in one curl command

This check uses an unauthenticated or IP-allowlisted SOCKS5 endpoint, so no password enters the command line. For a password-protected endpoint, run the same comparison from a test worker added to the provider's IP allowlist; command-line credentials can leak through shell history and process listings. Replace <PROXY_HOST> and <PROXY_PORT> with the assigned values. Tested with curl 8.7.1 on macOS 26.5.2.

export SOCKS_PROXY='<PROXY_HOST>:<PROXY_PORT>'
for scheme in socks5 socks5h; do echo "== $scheme"; curl --silent --verbose --output /dev/null --max-time 20 --proxy "$scheme://$SOCKS_PROXY" https://example.com/ 2>&1 | grep -E 'SOCKS5 connect'; done

Output captured through a local test proxy:

== socks5
* SOCKS5 connect to 172.66.147.243:443 (locally resolved)
== socks5h
* SOCKS5 connect to example.com:443 (remotely resolved)

The first line shows that curl looked up example.com itself and handed the proxy an address. The second shows that curl passed the name and let the proxy resolve it. The resolved address depends on the local resolver and changes over time.

Use socks5h in Python Requests

Install the optional SOCKS support with python -m pip install 'requests[socks]', then put the socks5h:// scheme in both mapping keys. Tested with Requests 2.34.2 and PySocks 1.7.1 through a local SOCKS5 test proxy, which printed the observed address:

import os

import requests

# Set SOCKS_PROXY to <PROXY_HOST>:<PROXY_PORT> for an unauthenticated or allowlisted endpoint.
proxy_url = f"socks5h://{os.environ['SOCKS_PROXY']}"
with requests.Session() as session:
    session.trust_env = False
    response = session.get(
        "https://api.ipify.org?format=json",
        proxies={"http": proxy_url, "https": proxy_url},
        timeout=(5, 15),
    )
    response.raise_for_status()
    print(response.json()["ip"])

Replace socks5h with socks5 to resolve names on the client instead. For a full Requests check with authentication and response validation, use the Python Requests proxy guide.

Know when proxy-side DNS matters

Choose socks5h:// in three common situations:

• Internal names. The name resolves only inside the proxy network: split-horizon DNS or an internal hostname fails locally but works at the proxy.
• Private lookups. Local DNS should not see the target names. With local resolution, the configured resolver receives every lookup before the proxy is used.
• Network-matched answers. The address should match the proxy's network. Some names return different addresses by resolver location, and a local answer can send traffic to a server chosen for the client's network.

socks5:// is reasonable when the target name resolves the same everywhere and local DNS is within the accepted data boundary. If socks5h:// succeeds while socks5:// fails, inspect local DNS reachability, split-horizon DNS, and resolver policy first.

Know what DNS mode does not change

The SOCKS5 request can carry an IPv4 address, an IPv6 address, or a domain name; RFC 1928 defines these address types. Username and password authentication is a separate method in RFC 1929, so authentication does not decide where DNS resolves.

DNS mode selects the resolver, not the exit country. Set the region through the provider's endpoint or session settings, then check the observed exit and the returned page separately. A site can choose a locale from signals other than the exit IP.

Proxy-side resolution does not make an application anonymous. The proxy receives the hostname in the SOCKS request. For HTTPS targets, TLS protects the HTTP content between client and target; it does not hide the SOCKS request or unrelated lookups made by other parts of the application, as curl's HTTPS proxy documentation explains for the separate proxy and TLS layers.

Check the whole application

A curl or Requests result describes that request only. Browsers, extensions, operating-system services, and other libraries can resolve names on their own path. The Chromium SOCKS proxy notes describe proxy-side resolution for proxied loads while DNS prefetch can still make separate local lookups.

A missing lookup counts as evidence only when the observation point covers the relevant resolver, cache, address family, process, and time window.

For transport differences, read HTTP vs SOCKS5 proxies. For Requests setup with a full validation script, use the Python Requests proxy guide. A provider can reproduce a specific route from a redacted proxy support ticket.

ProxyLaneTraffic never expires

Premium residential proxies
From $2/GB

Scale your workflows with the tools you already use. Rotating or sticky sessions up to 72 hours.

Try 350 MB for $1.95 View plans