Last Updated: March 20, 2025

​
About Destination Health Checks (DHC)

SGS can be configured to periodically monitor its available egress nodes for successful connectivity to particular services. This is only recommended for connecting to services which are particularly aggressive about blocking even high-quality residential IPs such as those provided by SGS.
SGS does not come configured with Destination Health Checks by default. If you feel that you need it in a specific region, notify your account manager. They will work with you to ensure that the SGS server you are using is configured to detect nodes’ connectivity to your desired service(s), for a nominal fee. Once configured, your account manager will provide you with a list of capability names, each of which represents one configured connectivity test.

​
Requesting DHC capability

When sending SGS a CONNECT request to route traffic that should be routed only via egress nodes that are marked as capable of supporting a given capability, the incoming request should specify the capability name (e.g., nflx) in one of two ways:
  1. By including an X-Sgs-Capabilities header whose value is nflx
$ curl -v --proxy-header 'X-Sgs-Capabilities: nflx' -x
'https://user4:{password}@sgs-server.salad.com' https://ipinfo.io/ip
* Trying 127.0.0.1:443...
* Connected to (nil) (127.0.0.1) port 443 (#0)
* allocate connect buffer!
* Establish HTTPS proxy tunnel to ipinfo.io:443
* Proxy auth using Basic with user 'user4'
> CONNECT ipinfo.io:443 HTTP/1.1
> Host: ipinfo.io:443
> Proxy-Authorization: Basic <PASSWORD>
> User-Agent: curl/7.81.0
> Proxy-Connection: Keep-Alive
> X-Sgs-Capabilities: nflx
  1. By appending a &cap= followed by the capability name, to the username portion of the authorization string.
$ curl -v -x 'https://user4&cap=nflx:{password}@sgs-server.salad.com'
https://ipinfo.io/ip
* Trying 127.0.0.1:443...
* Connected to (nil) (127.0.0.1) port 443 (#0)
* allocate connect buffer!
* Establish HTTPS proxy tunnel to ipinfo.io:443
* Proxy auth using Basic with user 'user4&cap=nflx'
> CONNECT ipinfo.io:443 HTTP/1.1
> Host: ipinfo.io:443
> Proxy-Authorization: Basic <PASSWORD>
> User-Agent: curl/7.81.0
> Proxy-Connection: Keep-Alive

​
Additional considerations

The special capability name any is active by default and specifies that any egress node, regardless of which capabilities it has, can service the request. If both the header and the username specify a capability, the capability specified in the username takes precedence. Currently, only one capability may be specified per request.
The SGS route association memory incorporates the capability name into the session ID. Thus, the session user4&cap=nflx vs user4&cap=bbc may be associated with different egress nodes. For purposes of route association memory, the capability specified via the X-Sgs-Capabilities header is incorporated into the username. For example, a connection specifying the nflx capability via header, but no capability in the user4 authorization header will be memorized as user4&cap=nflx