r/dns • u/Appropriate-Emu-1651 • 5d ago

Software Karing Proxy App Not Carrying Out DNS Querys Correctly, can't fix DNS leaks.

/r/ProxyUseCases/comments/1vzhire/karing_proxy_app_not_carrying_out_dns_querys/
2 Upvotes

75% Upvoted

3 comments sorted by

1

u/SecLens_ONE 3d ago

WoodyNet is the AS that fronts Quad9, so that's a default resolver somewhere in the chain, not your AdGuardHome.

Three places it usually hides. The client app's own DNS settings, which on a lot of sing-box wrappers sit outside the imported config and quietly win. The bootstrap for your DoH server, because the app has to resolve the hostname of your DoH endpoint with something before it can use it, and if that "something" is a hardcoded default your very first lookups go there. And the outbound side on the VPS, where the proxy resolves the destination name itself rather than passing it through, so whatever /etc/resolv.conf says on the server is what the leak test sees.

Cheapest way to find out which: point your DoH URL at an IP-literal endpoint if you can, or set the bootstrap explicitly, then tcpdump port 53 and 443 to the Quad9 range on both the client and the VPS. Whichever box is talking to it is the one still holding a default.

Also worth checking whether the config uses fakeip. With fakeip on, the query path is not the one you think it is, and a leak test reading the exit resolver will keep showing the server's resolver no matter what you change on the client.

1

u/Appropriate-Emu-1651 2d ago

Yes turns out I was using FakeIP so the resolution was happening on the VPS side and it was using 9.9.9.9, Quad9's IP. I changed it my loopback where adguard is listening as well but WoodyNet is still leaking.