Proxifier SOCKS5 Proxy Setup: Rules, DNS and Exit Checks

Proxifier routes the TCP connections of applications that lack their own proxy settings, for the whole computer or only for the programs its rules select. Databay supplies the route: an authenticated gateway at gw.databay.co, port 8888, that accepts HTTP proxying, HTTPS CONNECT tunnelling and SOCKS5 on one endpoint.

Proxifier decides which connections are captured and where they go; the Databay username decides the network, location and session behavior. Neither decides whether a destination permits the traffic, so use this setup only for applications and destinations you own or are authorized to test, and follow each destination's terms.

Proxifier's specifications describe processing outgoing TCP connections, and the gateway carries no UDP, so do not expect UDP traffic to follow your rules. Labels follow the Proxifier v4 for Windows documentation; Proxifier for Mac v3 still points to its v2 pages, and macOS differences are noted.

Choose Proxy Servers in the Profile menu, click Add, and take every value from your Databay dashboard. Routing choices travel inside the username, as in the documented example USER-zone-residential-countryCode-us, so copy the complete username instead of assembling one.

Proxifier defines HTTPS as an HTTP proxy with SSL tunnel support, also called a CONNECT proxy, which matches Databay's HTTPS CONNECT tunnelling. Skip the HTTP type, which Proxifier limits to HTTP connections. The HTTP versus SOCKS5 explainer covers the protocol differences.

After OK, Proxifier asks whether to use the proxy by default. Yes makes it the Default rule's action, sending every unmatched connection, updates and background sync included, through the gateway, where it is billed per GB; decline for a one-application setup. Choose the network before copying the username: Premium Residential targets one of country, state, city, ZIP, coordinate or ASN at a time, while Residential Flex, Datacenter and Mobile target a country or continent. All pools are shared.

Check in the proxy dialog opens the Proxy Checker (also under View > Proxy Checker); Start Testing runs it, and Test Settings sets the target host and port and which tests run. Use a target you are authorized to contact.

A pass means the checker reached gw.databay.co:8888, completed the protocol with the supplied credentials and reached its target at that moment. It does not prove that a rule matches your application, which country the exit reports, or that a destination will accept the traffic, and one latency reading is not a benchmark. The Mac v2 documentation lists the Proxy Checker as Windows only, so on macOS rely on the Connections list and the exit check below.

In Proxification Rules on the Profile menu, a connection matches a rule only when it meets all three criteria: Applications, Target hosts and Target ports. An empty field reads Any. Proxifier scans rules from top to bottom, and each action is Proxy, Chain, Direct or Block. Keep the predefined Localhost rule enabled; the Default rule catches everything else, and only its action can change.

Proxy Servers > Add       worksheet, not a profile file
  Address    gw.databay.co         Port   8888
  Protocol   SOCKS version 5       Label  databay-us-sticky
  Username   complete dashboard username
  Password   entered privately or at the login prompt

Proxification Rules, top to bottom
  Localhost      predefined                           Direct
  Browser test   firefox.exe, any host, any port      Proxy databay-us-sticky
  Tool web       "report tool.exe", ports 80;443      Proxy databay-us-sticky
  Tool other     "report tool.exe", any host or port  Block
  Default        everything unmatched                 Direct

Separate executable names with semicolons and quote names that contain spaces; * and ? wildcards work. When a tool should use Databay only on some ports, a Block rule for the same executable directly below stops its other connections from falling through to a Direct Default. Manual proxification from an .exe context menu ignores rules, and services or other users' programs need Profile > Advanced > Services and Other Users.

DNS leaks are controlled by Name Resolution, not by the proxy entry. By default Detect DNS settings automatically enables Resolve hostnames through proxy only when system DNS is unavailable, so on a working network your local resolver sees every name the proxified application looks up, and Proxifier sends the gateway an IP address.

To make the gateway resolve names, open Name Resolution on the Profile menu, turn off automatic detection and enable Resolve hostnames through proxy. A SOCKS version 5 entry then carries the hostname in the SOCKS5 request; Proxifier documents DNS over proxy for all its protocols. The Name Resolution documentation recommends the feature mainly when local resolution fails and lists the costs: applications receive placeholder addresses such as 127.8.*.*, and rules written with IP addresses stop matching. The setting is stored in the profile, not per rule, so retest anything left on Direct.

Keep LAN names local with Do NOT resolve the following and the %SimpleHostnames% and %ComputerName% constants, then set Log > Screen Log (Log > Output Level on Mac v2) to Verbose to see DNS requests; the status bar shows the current mode. The proxy's Advanced option Use target hostname in proxy request if available sends names but does not stop local lookups.

Before the real destination, remove any proxy the browser or operating system already uses: Proxifier's proxy settings page warns that a built-in proxy plus Proxifier can process a connection through a proxy twice.

# Windows PowerShell: names and switches only
Get-ChildItem Env: | Where-Object Name -match 'proxy' | Select-Object -ExpandProperty Name
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' |
  Select-Object ProxyEnable, ProxyServer, AutoConfigURL
netsh winhttp show proxy

# macOS Terminal
scutil --proxy
env | grep -i '_proxy' | cut -d= -f1

# curl (curl.exe on Windows) in a temporary rule, ignoring its own proxy settings
curl --disable --noproxy '*' --max-time 20 https://databay.com/what-is-my-ip/json

1. With the rule off, open Databay's What Is My IP page in the rule's browser and note the direct baseline.
2. Turn the rule on, reload, and record the observed IP, country estimate, UTC time and username variant.
3. Confirm that the Connections pane's Rule: Proxy column shows your rule and Databay entry, not Direct. A Target of gw.databay.co:8888 means the browser still uses its own proxy.
4. Only then open the authorized destination.

Proxifier tunnels each TCP connection separately. With a rotating username, a new gateway connection may select an available exit and a reused connection may keep its exit; a different address is not promised. For continuity, use a sticky username such as USER-zone-residential-countryCode-us-sessionId-abc123, which requests continuity for up to 1440 minutes on Premium Residential and Residential Flex where available, or up to 120 minutes on Datacenter and Mobile. The IP can change before the window ends. Check it at checkpoints. An observed IP is not proof of anonymity (see the anonymity levels guide). If the address alternates with your own, look for traffic the TCP rule does not carry, such as UDP. The Portable Edition does not process console programs, so run curl on the Standard Edition.

The Proxy Chains documentation sets the limits: a chain can mix SOCKS v4, SOCKS v5 and HTTPS servers, an HTTP proxy must be last, one failed proxy breaks the chain, and latency adds up. Create one with the Proxy Chains button and Create, drag entries into connection order, and select it as a rule's Chain action.

With Databay, a chain mainly fits a network that requires an approved outbound proxy first. Place that proxy first and Databay last, because the last hop is what a destination observes, and confirm with the network owner that the first proxy may reach gw.databay.co:8888. The Type button switches a chain to Redundancy or Load Balancing; in a Redundancy chain, keep Connect directly if all proxies fail, under Options, unchecked when traffic must not leave from your own address.

Set Log > Screen Log to Verbose, or Debug, for one bounded test and read the Output pane beside the Connections pane, whose Time/Status column shows Connecting, Closed, Failed or Canceled; the Traffic pane shows whether data moved. Classify the first failing hop: TCP to the gateway, authentication, the SOCKS5 or CONNECT request, then destination TLS and HTTP status.

On macOS, error codes follow standard values; the Mac v2 documentation lists 60 for a timeout and 61 for a refused connection. The connection loop page covers conflicts with local tunnelling or antivirus software; the cURL proxy guide adds a second client for isolating the layer.

Proxifier saves the profile after every change, and profiles can hold proxy passwords. Before typing the credential, set Profile > Advanced > Password Encryption to Current user account (Windows DPAPI) or Profile master password (AES 256-bit, requested at each load). File > Export Profile asks the same question. Never commit or share a .ppx file with readable passwords, and keep passwords out of a global Default.ppx, which loads for every user.

On shared machines, leave the password empty and let the advanced authentication options prompt for it; without Save to Profile, nothing reaches disk. SOCKS5 (RFC 1929) and Basic proxy authentication send credentials unencrypted on the hop to the gateway, so use trusted networks and keep destinations on HTTPS. Treat Debug logs and traffic dumps as sensitive and delete them after review, never screenshot the dialog with credentials visible, and replace any password that leaks. Keep the credential itself in a secret manager, not in notes or chat.