I just want to add a potential gotcha that bit me in the past:
At least with curl (or any library that uses curl under the hood) you have to be very careful to specify the scheme as socks5h:// with a letter h at the end, not just socks5. Otherwise the hostname lookup would happen directly through the client rather than the proxy.
So Tor Browser (fork of Firefox ESR with various custom patches and tor bundled in) sends all DNS requests over tor (presumably Brave does the same thing if they're doing their jobs right) via tor's SOCKS5 interface.
This means if you make a request for a clearnet service (e.g. example.com), that request goes to the daemon, which forwards it through the tor network to the exit node. That node sends a DNS request to whatever DNS server it is configured to use.
In the case of an onion-service (e.g. riseup.net's onion-service vww6ybal4bd7szmgncyruucpgfkqahzddi37ktceo3ah7ngmcopnpyyd.onion) the tor daemon itself notices 'oh hey it's a .onion tld' and will try to resolve using its internal onion-service related machinery. This type of request will never go to a DNS server.
However, it can get weird if you're configuring a piece of software that somehow is not 'tor-aware' to use tor as a SOCKS5 proxy, and then request an onion-service. In the case of curl for instance it will(would?) reject the request since .onion is not a valid general TLD (per RFC 7686) to avoid leaking the .onion name to DNS servers (see https://daniel.haxx.se/blog/2024/05/17/curl-tor-dot-onion-an... for more info).
Another failure mode is software somehow doing its DNS requests internally rather than relying on the SOCKS endpoint it's configured with:
let ip_address = DNSResolver.resolve("www.example.com");
let socket = TCP.connect(ip_address);
In this example, the domain name would be resolved with the user's own locally configured DNS, and then connect to the website over tor which would allow correlation of the anonymous connection with you under the right circumstances.
Yet another failure mode is if the application's protocol somehow includes local network info (e.g. your IP) embedded in its protocol's packets. If you were to naively tunnel this traffic over tor, you wouldn't actually have anonymity since the app itself would be snitching on you.
---
So in general, one should not naively tunnel arbitrary traffic over tor if your goal is anonymity. There's a reason (well, lots of reasons) why Tor Browser requires regular maintenance beyond 'lol just configure Firefox to use tor, job done'. There is a surprising amount of subtlety and complications around browsing the web over tor so if that's your goal, please just use Tor Browser.
Also in general, if you need your anonymity please do prefer software which has bundled+configured tor in it correctly, rather than just rolling your own (unless you actually know what you're doing, understand your threat model, how all these pieces interact, etc).
I'm asking because I have a web server that uses dynamic subdomains for sandboxing websites and I'm thinking about letting it run as onion service. However, the server needs to know the domain it's hosted on, which would be an .onion domain.
Comments
Yes but only if you connect through the SOCKS or HTTP proxy service provided by the Tor daemon.
There's no DNS when using a proxy. The proxy does DNS.
I just want to add a potential gotcha that bit me in the past:
At least with curl (or any library that uses curl under the hood) you have to be very careful to specify the scheme as socks5h:// with a letter h at the end, not just socks5. Otherwise the hostname lookup would happen directly through the client rather than the proxy.
https://curl.se/libcurl/c/CURLOPT_PROXY.html
Do you happen to know how browsers like Brave do it?
So Tor Browser (fork of Firefox ESR with various custom patches and tor bundled in) sends all DNS requests over tor (presumably Brave does the same thing if they're doing their jobs right) via tor's SOCKS5 interface.
This means if you make a request for a clearnet service (e.g. example.com), that request goes to the daemon, which forwards it through the tor network to the exit node. That node sends a DNS request to whatever DNS server it is configured to use.
In the case of an onion-service (e.g. riseup.net's onion-service vww6ybal4bd7szmgncyruucpgfkqahzddi37ktceo3ah7ngmcopnpyyd.onion) the tor daemon itself notices 'oh hey it's a .onion tld' and will try to resolve using its internal onion-service related machinery. This type of request will never go to a DNS server.
However, it can get weird if you're configuring a piece of software that somehow is not 'tor-aware' to use tor as a SOCKS5 proxy, and then request an onion-service. In the case of curl for instance it will(would?) reject the request since .onion is not a valid general TLD (per RFC 7686) to avoid leaking the .onion name to DNS servers (see https://daniel.haxx.se/blog/2024/05/17/curl-tor-dot-onion-an... for more info).
Another failure mode is software somehow doing its DNS requests internally rather than relying on the SOCKS endpoint it's configured with:
In this example, the domain name would be resolved with the user's own locally configured DNS, and then connect to the website over tor which would allow correlation of the anonymous connection with you under the right circumstances.
Yet another failure mode is if the application's protocol somehow includes local network info (e.g. your IP) embedded in its protocol's packets. If you were to naively tunnel this traffic over tor, you wouldn't actually have anonymity since the app itself would be snitching on you.
---
So in general, one should not naively tunnel arbitrary traffic over tor if your goal is anonymity. There's a reason (well, lots of reasons) why Tor Browser requires regular maintenance beyond 'lol just configure Firefox to use tor, job done'. There is a surprising amount of subtlety and complications around browsing the web over tor so if that's your goal, please just use Tor Browser.
Also in general, if you need your anonymity please do prefer software which has bundled+configured tor in it correctly, rather than just rolling your own (unless you actually know what you're doing, understand your threat model, how all these pieces interact, etc).
Thanks for this through explanation!
I'm asking because I have a web server that uses dynamic subdomains for sandboxing websites and I'm thinking about letting it run as onion service. However, the server needs to know the domain it's hosted on, which would be an .onion domain.
Happy to hep :3