> "Applications that do not implement the Tor protocol SHOULD generate an error upon the use of .onion and SHOULD NOT perform a DNS lookup." The RFC is still a

> "Applications that do not implement the Tor protocol SHOULD generate an error upon the use of .onion and SHOULD NOT perform a DNS lookup." The RFC is still a "Proposed Standard" and that sentence is probably a mistake. Even applications that are designed to use Tor like the Tor Browser don't "implement the Tor protocol", tor implements the Tor protocol and other applications use tor via SOCKS. Or not even that now that there are things like torify. The problem is there is a trade off between a) applications that know nothing of Tor leaking the onion name lookups from people who actually need anonymity into the public DNS when Tor is not installed or configured correctly, and b) breaking things for people who want the widest variety of application support via Tor, who aren't interested in anonymity and are only using it for e.g. NAT traversal. (The Tor people like to encourage the second group because more users improves overall anonymity.) A possible solution is Tor providing a particular innocent name that will resolve via Tor but not via public DNS, and then applications that can't resolve that name should not try to resolve any other onion names, and DNS caches like dnsmasq should by default return NXDOMAIN for that name without forwarding the query.