MoneroForum
Monerica468x60_v1Your ad here
Monero Monero Help Started Jul 14, 2026 9:34 AM

tor tells me monero may be leaking DNS

4 replies - 288 views - 2 thanks - 0 tippers - 3 watchers

Jul 14, 2026 9:34 AM
#1
tor leaks support

Hi,

I'm running a pruned monero node over tor for some time now. Everything was fine until some days.

I'm now having many warnings in the tor's notices' log :

[warn] Your application (using socks4 to port 18080) is giving Tor only an IP address. Applications that do DNS resolves themselves may leak information. Consider using Socks4A (e.g. via privoxy or socat) instead. For more information, please see https://2019.www.torproject.org/docs/faq.html.en#WarningsAboutSOCKSandDNSInformationLeaks. [5 similar message(s) suppressed in last 60 seconds]

And also many notices :

[notice] Closed 1 streams for service [scrubbed].onion for reason resolve failed. Fetch status: No more HSDir available to query.

When I stop the monero node, these warnings ans notices stop. All of them didn't appear until a few days, AFAIK without having done anything. tor and monero are always up to date.

These warnings appeared with monero 0.18.5.0 version, but remain with the last 0.18.5.1 version. tor was already the latest 0.4.9.11. version.

In the same time, my p2pool node can't connect anymore to other p2pool peers (it is set up to use tor too ; it is up to date too).

The monero conf file includes :

p2p-bind-ip=127.0.0.1
no-igd=1
proxy=127.0.0.1:9050
tx-proxy=tor,127.0.0.1:9050,10,disable_noise
anonymous-inbound=mylongonionadress.onion:18084,127.0.0.1:18084,12
disable-rpc-ban=1

What's happening ? Any clues to get my monero and p2pool nodes working again ?
All the best

2 thanks - 0 tippers - 3 watchers
Monerica468x60_v1Your ad here

Replies

Page 1 of 1 - 4 total
Jul 14, 2026 9:12 PM Edited Jul 14, 2026 9:12 PM
#3

@obviously_vision While my knowledge on these types of issues is limited, when i was first getting a node up and running, I recall reading something that if you check the 'SOCKS5 Proxy' option in the 'interface' section of 'Settings', that it can leak IP. Not sure if you have that checked or not, and not even almost sure that would be the issue even if, but it is something I came across as a potential issue. I'd say definitely get a more informed answer than this, but couldnt hurt to try in the meantime if you do have it enabled. Can always put it back.

Signature

principles over profit

2 thanks - GamingResearchLab, obviously_vision - 1 tippers
Login to tip
Jul 15, 2026 8:57 AM
#4

Hi,
thanks for your interest,
@nemesis, the option your are speaking about is in the GUI, isn't it ?
I read something similar on the net : socks4 and socks5 tend to use IP, only socks4a uses hostnames and seems to be safer.
I found in the "proxies.md" doc (here https://github.com/monero-project/monero/blob/master/docs/proxies.md) that the --proxy line without any indication of the type of socks implies the use of socks4a. So, I still don't understand why there is a possible leak.
This is probably not due to a compromised OS or software : I tried on another OS (debian), on a fresh tor install with the latest monerod, the same warnings and notices appear.
Still looking for some clues...

2 thanks - GamingResearchLab, nemesis - 0 tippers
Login to tip
Jul 15, 2026 12:39 PM
#5

@obviously_vision
Yes, I was referring to to GUI version. But as I said, my knowledge on 'under the hood' issues is limited. I kept it unchecked on mine and can still access thru my tor 'hidden service'. Am I leaking IP? Not sure but will be checking when I get back home.

Signature

principles over profit

1 thanks - GamingResearchLab - 1 tippers
Login to tip

Post A Reply

You must be logged in to reply. Login or register.