# How to check a proxy before you use it > Check that a proxy answers and tunnels, where its exit really is, whether the address is residential or blocklisted, and that the browser stays behind it. Source: https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it ## How to check a proxy before you use it Confirm the proxy answers and tunnels an HTTPS connection, read the exit address and location it actually gives you, check that address against blocklists and whether it is residential or a data center, then test from inside the browser that WebRTC and DNS do not leak your own address. ![Check the proxy, then the account, beside a screenshot: a proxy check result in Mosaic: latency, exit address, ISP, HTTPS tunnelling and reputation](https://mosaicbrowser.com/covers/how-to-check-a-proxy-before-you-use-it.webp) A proxy that connects is not the same as a proxy you can trust an account to. The check has four layers: does it work, where does it really exit, is that address any good, and does the browser stay behind it. Most people only do the first. ## 1. Does it answer, and does it tunnel? The first check is whether the proxy accepts your credentials and carries a connection. That has two parts, and the second one is easy to miss. An HTTP proxy can answer a plain request and still refuse a `CONNECT` tunnel, which is how every HTTPS page is loaded. A proxy that answers but does not tunnel will show you an error on nearly every site. By hand, from a terminal: ``` curl -x http://USER:PASS@HOST:PORT https://api.ipify.org ``` If that prints an IP address, the proxy authenticated you and tunneled an HTTPS request. For SOCKS5, use `socks5h://` instead of `http://` so DNS is resolved through the proxy too. Mosaic does this for you on every launch. It supports HTTP, HTTPS and SOCKS5 with authentication, and it will not open a profile behind a proxy that has not answered and tunneled. The refusal says what went wrong, instead of a generic error. That rule exists because the alternative, a browser that quietly falls back to your own connection, logs an account in from your home IP. ## 2. Where does it really exit? The address you connect to is the gateway. The address websites see is the exit, and they can be in different countries. Read the exit from the outside: the IP a lookup service sees, and the location that IP resolves to. Then compare it with what you paid for. Proxy sellers route through pools, and "Germany" in a plan name is a request. If the exit is in the wrong country, do not use it for an account that is supposed to live in Germany. Mosaic records the exit's address and location on every check and sets the profile's timezone and language from that measured location, not from the label. ![A proxy check result in Mosaic: exit address, location, latency and reputation](https://mosaicbrowser.com/shots/proxy-check.png) *A checked proxy: exit address, city and country, latency and reputation, with the time of the check.* Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Provider minting](https://mosaicbrowser.com/features/proxy-providers) ## 3. Is the address any good? An exit address with a bad history gets an account flagged before anyone looks at the fingerprint. It is the first and cheapest check a platform makes. Three things are worth knowing. **Is it on a blocklist?** Public DNS blocklists record addresses reported for spam, open proxies and abuse. They are queried with a DNS lookup of the reversed address, and a listing is a concrete fact you can check. Mosaic queries SpamCop, Barracuda, SORBS and s5h, chosen because they answer queries from an ordinary computer. A list that refuses those queries would return an answer that looks like a result and is not one, and a check that lies is worse than a missing one. **Is it residential or a data center?** The network classification from a geo lookup tells you whether the address belongs to a home ISP or a hosting company. For consumer platforms, a data center exit stands out; see [residential proxy](https://mosaicbrowser.com/glossary/residential-proxy) for why. **What does reverse DNS say?** Many hosting providers name themselves in the PTR record of their addresses. An exit whose reverse DNS reads like a server farm is a server farm. Mosaic puts these together as an exit reputation score on the proxy row, so you can score an address before an account goes near it. ## 4. Rotating proxies need one more step A rotating endpoint hands out a different exit per connection or per few minutes. Any reputation score you take is then a score of one random address from the pool, not of the address your profile will use. Pin a sticky session first, then check the session. Mosaic says this on the check itself when it sees a rotating endpoint, rather than giving you a score that means nothing. Sessions also die. Measured on one residential pool, a session that reaches nothing stays dead for every attempt on that same token, while fresh sessions on the same gateway answered normally. So when a session fails, the fix is a new session, not a retry. Mosaic's [provider accounts](https://mosaicbrowser.com/features/proxy-providers) mint a new session when one dies and write it back, and leave alone any session you pinned yourself. ## 5. Does the browser stay behind it? The last check happens inside the browser, because a proxy only covers what the browser sends through it. WebRTC can reveal addresses outside the proxy path. DNS can be resolved locally and reveal your ISP. And timezone, language and geolocation can all report your real location even when the IP is perfect. Mosaic's leak test runs from inside the profile's own page and reports WebRTC, DNS, timezone, language and geolocation for that profile behind its proxy. Run it once for every new proxy and every new profile. ## A short checklist 1. The proxy answers and tunnels HTTPS. 2. The exit is in the country and city you need. 3. The exit is not on a blocklist. 4. The exit is residential if the account is on a consumer platform. 5. For rotating proxies, a sticky session is pinned and checked. 6. The leak test shows no WebRTC, DNS, timezone or language leak. When every line passes, the proxy is ready for an account. [Managing multiple accounts without getting them linked](https://mosaicbrowser.com/guides/how-to-manage-multiple-accounts-without-getting-linked) covers what comes next: one exit per profile, and the fingerprint matched to it. ## Questions ### Why does my proxy show a different country than I bought? Proxy sellers route through pools, and the location in a product name is a request, not a guarantee. Always read the exit's location from a lookup after connecting, and refuse an exit in the wrong place. ### Is a fast proxy a good proxy? Not necessarily. Latency tells you whether browsing will be pleasant. Reputation tells you whether an account will survive. A fast data center address on a spam blocklist is worse than a slower clean residential one. ### How do I check a rotating proxy? Any score you take is one sample from the pool, not the address a profile will browse from. Pin a sticky session first, then check that session, and check again if the session changes. ### What is a WebRTC leak? WebRTC can reveal local and public IP addresses to a page outside the proxy path. A browser that leaks it tells a site your real address even though every page request went through the proxy. ### How often should I check a proxy? Before every launch. A proxy that worked yesterday can be dead, rotated or moved today. Mosaic checks before each start and will not open a profile behind a proxy that has not answered. ## Related [Residential proxy: an exit on a home internet connection](https://mosaicbrowser.com/glossary/residential-proxy): A residential proxy sends your traffic out through an address an ISP assigned to a home connection, so sites see a household rather than a data center. [Provider accounts: one gateway line, one exit per profile](https://mosaicbrowser.com/features/proxy-providers): Paste your proxy seller's gateway line once and Mosaic mints a separate session for every profile, so each one browses from its own exit address. [How to manage multiple accounts without getting them linked](https://mosaicbrowser.com/guides/how-to-manage-multiple-accounts-without-getting-linked): Accounts get linked by shared cookies, IPs, fingerprints and habits. Give each its own profile, exit and history, then test it before you trust it. [What is an anti-detect browser?](https://mosaicbrowser.com/guides/what-is-an-anti-detect-browser): An anti-detect browser gives each profile its own fingerprint, proxy and cookies, so sites see separate visitors. What it changes, how, and its limits. [Mosaic for agencies and media buyers managing ad accounts](https://mosaicbrowser.com/use-cases/ad-account-management): Keep each client's ad platform logins, two-factor codes and sessions in their own browser profile, and see their ads from the client's own market. [Chrome SOCKS5 proxy with username and password](https://mosaicbrowser.com/guides/chrome-socks5-proxy-with-username-and-password): A Chrome SOCKS5 proxy with username and password fails: Chromium has no SOCKS5 sign-in. Use the seller's HTTP port, allowlist your IP, or relay it. [How to use a different proxy for each Chrome profile](https://mosaicbrowser.com/guides/use-a-different-proxy-for-each-chrome-profile): Chrome has no proxy setting per profile. Use a proxy extension in each profile, or launch Chrome with its own data folder and --proxy-server.  ## Run this guide on your own accounts Every Mosaic profile is a fingerprint, a proxy exit and a cookie jar that agree with each other, kept on your computer. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.