A DNS proxy is a small server that sits between your devices and the DNS resolvers they use. It takes each name lookup, such as “what is the address of example.com”, passes it to an upstream resolver, and hands the answer back, often keeping a copy for next time or blocking names you don’t want resolved. This guide explains how one works, what people run it for, which software does the job, what “Smart DNS” really is, and why it is a different tool from the residential proxies used for scraping and geo-testing.
The short version
A DNS proxy forwards DNS queries from clients to an upstream resolver and returns the answers, usually adding caching, filtering or encryption on the way. It only handles name lookups: the website you then connect to still sees your own IP address. If you need a site to see a different IP, in another country or on a residential network, you need a web proxy (HTTP or SOCKS5), not a different DNS setup.
What Is a DNS Proxy Server?
A middleman for name lookups, and nothing elseEvery time a browser, app or script connects to a host name, it first asks the Domain Name System for the matching IP address. Normally that question goes from your device to a recursive resolver run by your internet provider, your company or a public service, and the resolver does the work of finding the answer. A proxy of this kind is a component placed in the middle of that exchange. Clients send their queries to the proxy; the proxy sends them on to one or more upstream resolvers and relays the replies back.
The IETF’s guidance on the subject, RFC 5625 “DNS Proxy Implementation Guidelines” (Ray Bellis, 2009), was written because this kind of forwarder is built into almost every broadband router. Its core advice is that a proxy should be transparent: receive requests from the local network, forward them verbatim to a known upstream resolver, and return the responses unchanged. That way it doesn’t break newer DNS features it doesn’t understand. It also says a proxy must accept and forward queries over TCP, not just UDP, and must pass through record types it doesn’t recognise.
Most real deployments go further than a pure relay. The software you are likely to meet caches answers, lets you define local names, blocks domains from a list, or upgrades plain DNS to an encrypted protocol before it leaves your network. The name stays the same because the basic shape stays the same: clients on one side, resolvers on the other, the proxy in between.
One distinction is worth making early. A forwarder isn’t a resolver. A recursive resolver walks the DNS tree itself, from the root servers down to the authoritative server for a domain. A forwarder hands that work to someone else. Some programs can do both, but when people say “DNS proxy” they almost always mean the forwarding role.
Key takeaways
- It sits between clients and upstream resolvers and forwards lookups in both directions.
- Typical extras are caching, domain blocking, local names and encrypted upstream DNS (DoH or DoT).
- Your home router almost certainly already runs one.
- It only answers “which IP is this name?”. Your traffic to the site itself still leaves from your own IP.
- Changing what a site sees about your location needs a web proxy or a VPN, not a different DNS setup.
How a DNS Proxy Works
Receive, check, forward, cache, replyTake a laptop on a home network whose router hands out its own address as the DNS server. The laptop wants to open example.com:
Laptop (192.168.1.23)
|
| query: example.com A? (UDP or TCP port 53)
v
+----------------------------------+
| Forwarder (router or server) |
| 1. answer from cache if fresh |
| 2. apply block / local rules |
| 3. forward to upstream resolver |
| 4. store the answer, with TTL |
+----------------------------------+
|
| forwarded query (plain, DoT on 853 or DoH on 443)
v
Upstream recursive resolver
|
v
Root -> .com -> example.com authoritative servers- The client sends a query. Plain DNS uses port 53, over UDP for most queries and TCP when a reply is too large or a zone transfer is involved. RFC 1035 defines both transports.
- The proxy checks its cache. If it has a fresh answer, meaning one whose time-to-live hasn’t run out, it replies straight away. This is where the speed benefit comes from: a repeat lookup is answered on the local network.
- It applies local rules. A name on a blocklist can be answered with nothing, or with an address that goes nowhere. A local name such as nas.home can be answered from a static entry.
- It forwards the rest. Anything it can’t answer goes to one or more upstream resolvers. Depending on the software, that hop can stay plain DNS or be upgraded to DNS over TLS (port 853, RFC 7858) or DNS over HTTPS (RFC 8484).
- It relays and stores the answer. The reply goes back to the laptop and into the cache until its TTL expires.
The laptop then opens a normal connection to the IP address it was given. The forwarder plays no part in that connection. This is the single most misunderstood point about the technology, and it matters for everything later in this guide.
What DNS Proxies Are Used For
The jobs people actually deploy one forNotice what is missing from that list: hiding your IP address from websites, or making a site think you are in another country. A DNS forwarder does neither, however it is configured.
DNS Proxy Software
Well-known open-source options, by the job they do bestPeople looking for a list of these usually want one of two things: a program to run, or a public resolver to point at. For the first, these are the tools you will see most often. Each description comes from the project’s own documentation.
| Software | What its documentation says it is | Good fit for |
|---|---|---|
| dnsmasq | Network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It forwards all query types to upstream recursive servers and caches common record types. | Routers, small offices, tethering, test networks |
| Pi-hole | A DNS sinkhole for network-wide ad blocking on your own Linux hardware. Its engine, FTLDNS, is built on dnsmasq. | Home networks that want blocking with a web dashboard |
| AdGuard dnsproxy | A simple DNS proxy server that supports plain DNS, DNS-over-TLS, DNS-over-HTTPS, DNSCrypt and DNS-over-QUIC, both upstream and as a listener, with optional caching. Apache-2.0 licensed. | Turning plain DNS into encrypted DNS on one machine or a small network |
| CoreDNS (forward plugin) | Forwards queries to upstream resolvers over UDP, TCP, DNS-over-TLS or DNS-over-HTTPS, with in-band health checks and up to 15 upstreams. | Containers and Kubernetes clusters |
| Unbound | A validating, recursive, caching DNS resolver. It can also be set to forward, but its main job is resolving on its own. | Running your own resolver instead of relying on someone else’s |
For the second meaning, a public resolver isn’t a proxy in the sense used here. Pointing your device at a public resolver changes who answers your lookups. It doesn’t add a forwarder in the middle, and it doesn’t change the IP address that websites see.
Smart DNS: the Other Thing Called a DNS Proxy
Why streaming DNS services are really web proxies with a DNS trickA lot of consumer sites use the same name to mean a Smart DNS service. These are usually sold for watching region-locked streaming catalogues, and the name hides how they work. Changing DNS alone can’t change your IP address, so these services have to relay some traffic too.
The common design is simple. You set your device or router to use the service’s DNS servers. For most domains they answer normally. For the specific domains they support, typically the ones a streaming service uses to check your location, they return the address of one of their own proxy servers in the target country instead of the real one. Your device connects to that server, and the server relays the connection on, so the site sees the proxy’s IP. Everything else goes direct, unencrypted and from your own IP.
So Smart DNS is really a web proxy that is switched on for a short list of domains by a DNS rule. It works for the sites the provider has prepared and for nothing else, and it doesn’t encrypt anything. If streaming is the goal, that is the category of product to look at. A proxy network built for data collection, ProxyEmpire included, is the wrong tool: streaming platforms such as Netflix are blocked on ProxyEmpire’s network, along with banks, payment processors and government sites.
A DNS change can point you to a proxy. It can’t be one.
DNS Proxy vs Web Proxy (HTTP and SOCKS5)
Different layer, different jobSearches like “proxy vs DNS” and “is a proxy the same as DNS” come up because both sit between you and the internet. They sit in very different places, though:
| DNS proxy | Web proxy (HTTP / HTTPS / SOCKS5) | |
|---|---|---|
| What passes through it | Name lookups only | The actual connection: requests, pages, API calls, files |
| IP address the website sees | Yours | The proxy’s exit IP |
| Changes your apparent location | No | Yes, to wherever the exit IP is |
| Typical ports | 53 (plain), 853 (DoT), 443 (DoH) | Whatever the provider publishes, for example 5000 on ProxyEmpire |
| Main uses | Caching, blocking, filtering, encrypted DNS, local names | Web scraping, price and ad checks, geo-testing, account management, privacy |
| Who uses it | Network owners protecting or speeding up their own devices | Teams that need their traffic to come from other IPs |
Put another way: a DNS forwarder decides where your connection should go. A web proxy is the place your connection actually goes through. They combine well. Many companies run a DNS forwarder for their own network and still send outbound data collection through a proxy network. They just aren’t substitutes for each other.
What Happens to DNS When You Use a Proxy
Who resolves the host name decides what leaksThis is where DNS and web proxies do meet, and it’s the part that matters to anyone using proxies for real work. When your client connects through a proxy, the host name has to be turned into an IP address somewhere. If your own machine does it, your local resolver sees every domain you visit, and the answer is tuned to your location rather than the proxy’s. That is usually called a DNS leak.
HTTP and HTTPS proxies
With an HTTP proxy, the client sends the host name to the proxy. For HTTPS it uses the CONNECT method, which RFC 9110 describes as asking the recipient to establish a tunnel to the destination named in the request target. The request target is a host name and port, such as example.com:443. The proxy side does the lookup, so your local resolver never sees the destination.
SOCKS5 proxies
SOCKS5 can go either way. RFC 1928 lets a connect request carry an IPv4 address, an IPv6 address or a fully qualified domain name. If the client resolves the name itself and sends only the IP, the lookup happens on your machine. If it sends the domain name, the proxy resolves it. curl makes the difference explicit: the socks5:// scheme resolves locally, while socks5h:// means, in curl’s own words, the proxy resolves the URL host name.
# the name is resolved on your machine, then the IP is sent to the proxy
curl -x socks5://USER:PASS@v2.proxyempire.io:5000 https://example.com/
# the name is sent to the proxy and resolved there
curl -x socks5h://USER:PASS@v2.proxyempire.io:5000 https://example.com/
# HTTP proxy: the host name travels inside the CONNECT request
curl -x http://USER:PASS@v2.proxyempire.io:5000 https://example.com/Browsers and automation tools have equivalent settings. Look for an option that sends DNS through the SOCKS proxy, or use an HTTP proxy, where the host name travels in the request anyway. For geo-testing this matters twice over: sites and CDNs often choose which server or content to return based on where the lookup came from, so a local lookup can give you your own country’s answer even when the connection itself exits somewhere else.
Setting Up a DNS Proxy
Two minimal examplesIf you only want a forwarder with a cache on one Linux machine or a small network, dnsmasq needs just a few lines. The option names below come from the dnsmasq manual page:
# listen only on these addresses
listen-address=127.0.0.1,192.168.1.2
# ignore /etc/resolv.conf and use these upstream resolvers
no-resolv
server=1.1.1.1
server=9.9.9.9
# keep up to 1,000 answers in memory
cache-size=1000
# answer a local name directly
address=/nas.home/192.168.1.20To turn plain DNS into encrypted DNS instead, AdGuard’s dnsproxy can listen locally and forward over DNS-over-HTTPS. The flags are from its README: -l sets the listen address, -p the port, -u the upstream and -b a bootstrap resolver used to find the upstream’s own address.
./dnsproxy -l 127.0.0.1 -p 5353 -u https://dns.adguard.com/dns-query -b 1.1.1.1:53 --cacheThen point the device’s DNS setting, or the router’s DHCP setting, at the proxy’s address. On Windows, that is the adapter’s IPv4 properties under “Use the following DNS server addresses”. On most routers, it is the DNS field in the LAN or DHCP section. Test with nslookup example.com 127.0.0.1 or dig @127.0.0.1 example.com before you roll it out to everyone.
Where ProxyEmpire Fits
What we are, and what we are notProxyEmpire isn’t a DNS proxy, and it isn’t a Smart DNS service. It is a web proxy network: your client connects to v2.proxyempire.io:5000 over HTTP or SOCKS5 with a username and password (HTTPS proxy connections are supported too), and your requests leave from a residential, mobile or datacenter IP in the location you choose. We don’t carry UDP, and by default only web traffic on ports 80 and 443 goes through.
That makes it the right tool when the problem is the IP address a site sees, which a DNS change can’t fix:
- Seeing a site as local users see it. Rotating residential proxies and rotating mobile proxies can target a country, region, city, ZIP code, ISP or mobile carrier, ASN and OS fingerprint, all included at no extra charge. Send the host name to the proxy, as shown above, and the lookup doesn’t happen on your machine either.
- Collecting public data at scale. Rotate to a new IP on every request, or keep a sticky session with no fixed time limit: the IP stays until you rotate it or the device behind it goes offline.
- High-volume jobs that don’t need residential IPs. Rotating datacenter proxies start at $0.35/GB, with sticky or per-request rotation.
The network has more than 30 million ethically sourced residential IPs and more than 4 million mobile IPs, and 99.9% uptime on the public status page. Support is available 24/7 from real people. Residential bandwidth costs $3.50/GB pay as you go and falls to $1.50/GB on larger plans. Unused bandwidth rolls over, and a $1.97 trial lets you test the whole setup first. For how a proxy firewall differs from both of these tools, see our proxy firewall guide.
Frequently Asked Questions
Short answers to common questionsIs a DNS proxy the same as a DNS server?
Not quite. It is a DNS server from the client’s point of view, since it answers on port 53, but it doesn’t resolve names itself. It forwards them to an upstream resolver. A recursive resolver such as Unbound does the full lookup from the root servers down. Many programs can play either role.
Does a DNS proxy hide my IP address?
No. It only handles name lookups. After the lookup, your device connects to the website directly, and the website sees your normal IP address. Hiding or changing the IP a site sees needs a web proxy or a VPN.
Is a DNS proxy the same as a VPN?
No. A VPN carries all of your device’s traffic through an encrypted tunnel to another network. A forwarder only relays lookups, and it only encrypts them if it forwards over DoT or DoH.
What ports do DNS proxies use?
Plain DNS uses port 53 over UDP and TCP (RFC 1035). DNS over TLS uses port 853 (RFC 7858). DNS over HTTPS runs over normal HTTPS, usually port 443 (RFC 8484).
Is Smart DNS safe to use?
It depends on the provider you trust with your lookups. Smart DNS doesn’t encrypt your traffic, and the provider sees every domain your device looks up and relays the connections for the domains it supports. Treat it as a streaming convenience, not a privacy tool.
Can I use ProxyEmpire as a DNS proxy?
No. ProxyEmpire is an HTTP(S) and SOCKS5 proxy network for web traffic on ports 80 and 443, and it doesn’t carry UDP. What it can do is keep DNS off your machine for the requests you send through it: use an HTTP proxy, or a SOCKS5 setting that sends the host name, such as curl’s socks5h scheme.
Does changing my DNS change my location?
No. Websites judge location mainly by the IP address your connection comes from. A different resolver can change which server a CDN picks for you, but the site still sees your real IP and location.
References
Primary documentation- IETF — RFC 5625, “DNS Proxy Implementation Guidelines” (2009). rfc-editor.org/rfc/rfc5625
- IETF — RFC 1035, “Domain Names — Implementation and Specification”. rfc-editor.org/rfc/rfc1035
- IETF — RFC 7858, “Specification for DNS over Transport Layer Security (TLS)”. rfc-editor.org/rfc/rfc7858
- IETF — RFC 8484, “DNS Queries over HTTPS (DoH)”. rfc-editor.org/rfc/rfc8484
- IETF — RFC 9110, “HTTP Semantics”, the CONNECT method. rfc-editor.org/rfc/rfc9110
- IETF — RFC 1928, “SOCKS Protocol Version 5”. rfc-editor.org/rfc/rfc1928
- curl — CURLOPT_PROXY, proxy scheme prefixes (socks5 and socks5h). curl.se/libcurl/c/CURLOPT_PROXY.html
- dnsmasq — project overview. thekelleys.org.uk/dnsmasq/doc.html
- dnsmasq — manual page. thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html
- AdGuard — dnsproxy README. github.com/AdguardTeam/dnsproxy
- Pi-hole — documentation. docs.pi-hole.net
- CoreDNS — forward plugin. coredns.io/plugins/forward
- NLnet Labs — Unbound, about. nlnetlabs.nl/projects/unbound/about
Need sites to see a different IP, not a different resolver?
Residential, mobile and datacenter proxies over HTTP(S) and SOCKS5, with country-to-ZIP, ISP and ASN targeting at no extra charge, sticky or rotating sessions, and bandwidth that rolls over. Try ProxyEmpire for $1.97.
