For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/agent/configuration/proxy.md. A documentation index is available at /llms.txt.

Datadog Agent Proxy Configuration

You can configure the Datadog Agent to send traffic through an HTTP/HTTPS proxy. A proxy is typically used to send traffic from a host that is not directly connected to the public internet.

Configure the Datadog Agent

There are several options for configuring the Datadog Agent to use a proxy depending on your deployment method.

  • You can use the Agent configuration file.
  • You can use environment variables. Environment variables override configuration file settings.
  • For Kubernetes deployments, you can configure the proxy through Helm or the Datadog Operator.

Configuration file

To configure a proxy using a configuration file, edit or add the proxy section to the main Agent configuration file (datadog.yaml) and then restart the Datadog Agent.

proxy:
  # Required: Proxy endpoint for HTTP connections
  http: http://<USER>:<PASSWORD>@<PROXY_HOST>:<PROXY_PORT>
  # Required: Proxy endpoint for HTTPS connections (most Datadog traffic)
  https: http://<USER>:<PASSWORD>@<PROXY_HOST>:<PROXY_PORT>

  # Optional: List of hosts or CIDR ranges to bypass the proxy
  # Example:
  # no_proxy:
  #   - 192.168.0.0/24
  #   - localhost
  #   - .myinternaldomain.com
  no_proxy:
    - <HOST_TO_BYPASS_1>
    - <HOST_TO_BYPASS_2>

# Recommended: Set to true to ensure no_proxy behaves in a standard way
no_proxy_nonexact_match: true

# Recommended: Force the Agent to use HTTP to send logs (if logs is enabled)
logs_config:
  force_use_http: true
  • Replace <USER>, <PASSWORD>, <PROXY_HOST>, and <PROXY_PORT> with your proxy credentials and address.
  • A username and password are optional.
  • Specify http, https, or both, depending on your proxy setup and needs. Most Datadog traffic uses HTTPS.
  • Use no_proxy to specify hosts the Agent should connect to directly, bypassing the proxy.
  • Restart the Datadog Agent for changes to take effect.

For more information on locating the configuration file on your operating system, see Agent Configuration Files.

Environment variables

Alternatively, you can configure a proxy by setting the following environment variables. When you’re done, restart the Datadog Agent.

DD_PROXY_HTTP="http://<USER>:<PASSWORD>@<PROXY_HOST>:<PROXY_PORT>"
DD_PROXY_HTTPS="http://<USER>:<PASSWORD>@<PROXY_HOST>:<PROXY_PORT>"

DD_PROXY_NO_PROXY="<HOST_TO_BYPASS_1> <HOST_TO_BYPASS_2>"
DD_NO_PROXY_NONEXACT_MATCH=true

DD_LOGS_CONFIG_FORCE_USE_HTTP=true

Kubernetes

    Add the following to your values.yaml:

    datadog:
  env:
    - name: DD_PROXY_HTTP
      value: "http://<PROXY_SERVICE>.<PROXY_NAMESPACE>.svc.cluster.local:<PROXY_PORT>"
    - name: DD_PROXY_HTTPS
      value: "http://<PROXY_SERVICE>.<PROXY_NAMESPACE>.svc.cluster.local:<PROXY_PORT>"
    - name: DD_PROXY_NO_PROXY
      value: "<HOST_TO_BYPASS_1> <HOST_TO_BYPASS_2>"
    - name: DD_NO_PROXY_NONEXACT_MATCH
      value: "true"

    Add the following to your DatadogAgent CR:

    spec:
  global:
    env:
      - name: DD_PROXY_HTTP
        value: "http://<PROXY_SERVICE>.<PROXY_NAMESPACE>.svc.cluster.local:<PROXY_PORT>"
      - name: DD_PROXY_HTTPS
        value: "http://<PROXY_SERVICE>.<PROXY_NAMESPACE>.svc.cluster.local:<PROXY_PORT>"
      - name: DD_PROXY_NO_PROXY
        value: "<HOST_TO_BYPASS_1> <HOST_TO_BYPASS_2>"
      - name: DD_NO_PROXY_NONEXACT_MATCH
        value: "true"

    NO_PROXY accepted values

    By default, no_proxy/NO_PROXY must match endpoints exactly for Agent HTTP(S) requests (except requests performed by Agent integrations). Datadog recommends enabling no_proxy_nonexact_match to make the Agent match NO_PROXY values with the same rules used for Agent integrations.

      no_proxy_nonexact_match: true

      DD_NO_PROXY_NONEXACT_MATCH=true

      The following rules apply to Agent integrations (and the whole Agent when no_proxy_nonexact_match is enabled):

      • A domain name matches that name and all subdomains, for example:
        • datadoghq.com matches app.agent.datadoghq.com, www.datadoghq.com, datadoghq.com, but not www.notdatadoghq.com
        • datadoghq matches frontend.datadoghq, backend.datadoghq, but not www.datadoghq.com or www.datadoghq.eu
      • A domain name with a leading “.” matches subdomains only, for example:
        • .datadoghq.com matches app.agent.datadoghq.com, www.datadoghq.com, but not datadoghq.com
      • A CIDR range matches an IP address within the subnet, for example:
        • 192.168.1.0/24 matches IP range 192.168.1.1 through 192.168.1.254
      • An exact IP address, for example:
        • 169.254.169.254
      • A hostname, for example:
        • webserver1

      Proxy Server Setup Examples

      If you don’t have an existing proxy server, Datadog recommends using an HTTP proxy like Squid.

      1. Squid (Recommended): A robust HTTP/HTTPS proxy that simplifies configuration by transparently proxying all outbound HTTP/HTTPS Agent traffic. Using a Squid proxy.
      2. HAProxy (Not Recommended): Can forward traffic to Datadog, but this requires maintaining an up-to-date list of Datadog domains and is more complex to manage. See HAProxy Example Setup.
      3. NGINX (Not Recommended): Similar to HAProxy, using NGINX to forward traffic to Datadog is discouraged due to the maintenance overhead of keeping domain lists current. See NGINX Example Setup.

      Datadog discourages forwarding traffic using software like HAProxy or NGINX because it requires you to manually configure and maintain the list of specific Datadog endpoints the Agent needs to reach. This list can change, leading to potential data loss if not kept up-to-date. The only exception is if you need Deep Packet Inspection (DPI) capabilities, in which case you might consider using HAProxy or NGINX as they allow you to disable TLS or use your own TLS certificates and inspect the traffic.

      Verification

      Check the Agent status command and review the Agent logs (agent.log, trace-agent.log, etc.) for any connection errors after restarting.

      FIPS Proxy (US1-FED)

      For information on setting up the Datadog Agent FIPS Proxy with the Datadog Agent, see Datadog FIPS Compliance. The FIPS proxy is only available in the US1-FED region. The Datadog Agent FIPS Proxy cannot be used together with a regular proxy.

      Further reading

      Additional helpful documentation, links, and articles:

      Collect your logsDOCUMENTATION more more Collect your processesDOCUMENTATION more more Collect your traces and profilesDOCUMENTATION more more Datadog FIPS ComplianceDOCUMENTATION more more