A proxy can answer and still leak your real IP. Check the exit, DNS, WebRTC, protocol, and blocklists before you put the endpoint in production.

How to check if a proxy works (and whether it leaks your IP)

A proxy “working” means two different things. The gateway must accept your client and fetch a page. The rest of your device must also stop exposing the real IP. Plenty of endpoints pass the first test and fail the second.

Do this check before you scale a plan. Do it again after rotation. Pools change. Firmware on a phone browser changes. A passing test yesterday is not a contract.

01Confirm the exit IP first#

Point a simple client at the proxy. Use the same protocol and auth you will use in production. Then request a page that echoes the client IP.

The proxy checker is the short path for that first hop. It tells you whether the endpoint answers, which protocol it spoke, and which IP the destination saw. If this step fails, stop. DNS leaks do not matter on a dead gateway.

Open My IP through the same proxy. Read the country, the ASN, and the hosting versus residential label if the page shows one. Compare that to what you bought. A “US residential” product that exits on a cloud ASN is the wrong product, not a settings issue.

Repeat the lookup after you rotate. A mixed pool can hand you a different country on the next session id. If you paid for US proxies, the second sample should still be in the United States.

02Look for leaks around the proxy#

A proxy only covers traffic that your client sends through it. Everything else can still use your real network.

DNS is the common leak. The browser asks your ISP for a name before the proxy ever sees the URL. Force DNS through the proxy or through a resolver you chose. Then load a DNS leak test page while the proxy is on. The resolvers you see should not be your home ISP.

WebRTC is the browser-specific leak. Some browsers will open a peer connection that reveals a local or public address even when HTTP is proxied. Disable WebRTC in that profile, or use a tool that shows the candidate addresses. If a candidate is your real public IP, the profile is not safe for account work.

IPv6 is the quiet leak. You proxied IPv4 and the OS still has a global IPv6 address. Sites that prefer v6 will skip the proxy. Disable IPv6 on that profile or use a dual-stack proxy that you have actually tested on a v6 echo page.

Applications can bypass system proxies. A native app may ignore the OS setting and go direct. Test the app, not only the browser. SOCKS5 at the app layer is often the only reliable hook. See SOCKS5 vs HTTP if the client offers both.

03Check reputation, not only reachability#

An IP can fetch a page and still be useless for your job. Hosting flags, blocklists, and prior abuse all live on the address.

If the task is mail, sign-up, or anything that other people have already burned, run the exit through IP blacklist. A listing is a warning. It is not a moral judgment. Shared residential pools pick up listings. Dedicated datacenter IPs pick them up too.

If the task is scraping, fetch the real target URL, not only an echo service. Some hosts allow https://httpbin.org and still block your catalog page. Save the status code, the body length, and whether a challenge appeared. That is the only score that matters.

If the task is geo QA, compare the page you wanted with the page you got. Currency, language, and catalog should match the country you bought. A correct ASN with the wrong storefront means the site is using another signal.

04Make the check repeatable#

Write the steps down. Same client, same auth, same echo URL, same target URL, same leak pages. Run them when you buy. Run them when you rotate. Run them when a job starts failing.

Record the exit IP, ASN, protocol, and whether DNS or WebRTC showed your real address. When a vendor replaces a port, you will know what changed.

Do not skip auth mistakes. User and password in the wrong field look like a dead proxy. IP-allowlist auth looks like a dead proxy from a new office network. Fix auth before you open a ticket.

A proxy that answers, exits in the right country, hides your real IP, and returns the target page is working. Anything less is a partial pass. Keep it out of production until the missing part is closed.