SOCKS5 vs SOCKS5h: Where DNS Happens

For curl, choose socks5h:// when the proxy should resolve the destination name. Choose socks5:// when curl should resolve it locally and send an address to the proxy. Both use SOCKS5; the final h is a client URL convention.

Compare the modes using your SOCKS5 endpoint in place of the local listener:

curl --noproxy '' --proxy socks5://127.0.0.1:1080 --connect-timeout 5 --max-time 15 --verbose https://example.com/
curl --noproxy '' --proxy socks5h://127.0.0.1:1080 --connect-timeout 5 --max-time 15 --verbose https://example.com/

Only the resolution mode changes. --noproxy '' clears bypass rules for these calls, and the time limits bound the comparison. The equivalent dedicated options are --socks5 and --socks5-hostname. Use a hostname as the target: an IP literal needs no destination lookup and cannot demonstrate this difference.

A name can exist on only one side

Suppose the proxy runs inside a development network whose DNS knows an internal service name. Your laptop may fail to resolve that name in socks5 mode, while socks5h lets the proxy resolve it. Reverse the situation—a name defined only in your laptop's hosts file—and remote lookup may fail instead.

Public DNS can return different addresses from different networks too. A difference in results is a reason to compare the selected addresses and their reachability, rather than immediately replace the proxy.

• Cannot resolve the proxy hostname: neither mode can start. Your client still resolves proxy.example in socks5h://proxy.example:1080.
• Local destination lookup fails: inspect the client resolver or compare hostname mode.
• The SOCKS server rejects the destination: inspect its reply and policy. A successful local lookup does not establish remote reachability.
• Tunnel works, certificate verification fails: investigate destination TLS; selecting a different DNS mode is not a general trust fix.

A controlled test name and server-side logs can confirm which address type reached a proxy you administer. An exit-IP webpage cannot: it reports the outward connection, not where DNS happened.

The privacy benefit has a specific scope

Proxy-side lookup avoids this request's local destination lookup. It does not encrypt SOCKS, prove the proxy uses encrypted DNS, or route other applications and browser prefetch traffic. Requests with SOCKS support uses the same local-versus-proxy distinction; other clients may expose a setting instead of curl's URL spelling. Choose a protocol your application supports before copying an endpoint from the SOCKS5 proxy list.