Can Authoritative DNS Logs Reveal a Proxy User’s Original IP?
Separate the proxy’s HTTP exit address, a recursive resolver’s DNS query address and optional client-subnet information when interpreting a DNS privacy test.
An authoritative DNS server usually receives a website lookup from a recursive resolver. Its query log's source IP therefore often identifies that resolver, while the website's HTTP connection arrives from the forward proxy.
A unique hostname associated with one visit can correlate the DNS query and web request. It does not change which machine actually sends the query to the authoritative server.
That resolver may belong to the visitor's ISP, a public DNS service, the proxy network or another forwarding resolver. Seeing a different address from the HTTP exit is evidence of a different observation point, not automatic proof of the visitor's exact original IP.
There are exceptions. A visitor can operate a recursive resolver directly, and EDNS Client Subnet can expose information about a client network. The precision depends on what is actually sent, including the prefix length; a subnet is not necessarily one user's address.
When examining a proxy privacy test, label the observations separately: HTTP source, DNS query source and any client-subnet data. Local versus proxy-side destination lookup can change that DNS path, but a result needs those distinctions before it supports a claim about identity.