Understanding the Tor BadExit Flag

The BadExit flag is a critical security mechanism within the Tor directory system used to identify and isolate exit relays that are misconfigured, malicious, or actively interfering with user traffic. When Directory Authorities assign this flag to a relay, it signals Tor clients across the network to stop using that specific node for exiting to the open internet. This article explains how Directory Authorities detect problematic exit nodes, how the BadExit flag is distributed through the network consensus, and the direct impact it has on relay operations and user privacy.

Purpose of the BadExit Flag

Exit relays serve as the final bridge between the encrypted Tor network and the public internet. Because exit traffic is decrypted as it leaves the node, bad actors may attempt to run rogue exit relays to snoop on unencrypted protocols, inject malicious code, alter DNS responses, or perform Man-in-the-Middle (MitM) attacks.

The Tor network uses the BadExit flag to mark relays that violate the network’s integrity policies without necessarily kicking them off the network entirely.

How Directory Authorities Assign the Flag

The Tor network is governed by a small group of trusted servers known as Directory Authorities (DirAuths). These authorities continuously monitor, test, and vote on the status of all relays in the network.

1. Detection and Reporting: Automated scanning tools (such as exit scanners) and network administrators test exit relays for malicious behavior, such as SSL stripping, DNS tampering, port blocking, or payload modification.
2. Voting Consensus: Every hour, Directory Authorities vote on relay statuses to generate a unified network status consensus document. If a majority of the authorities agree that an exit node is malfunctioning or hostile, they append the BadExit flag to that relay’s entry in the consensus.

Impact on Client Routing and Relays

Once the consensus containing the BadExit flag is published, the following changes take effect immediately across the network:

• Exit Exclusion: Tor clients download the updated consensus and automatically filter out flagged relays when constructing exit paths. No client will choose a BadExit relay as the final hop for internet-bound traffic.
• Middle and Guard Relaying: Unlike a full ban (or the Reject status), a relay with only the BadExit flag can still function as an entry guard or a middle hop in a three-hop circuit, provided it is otherwise healthy. Traffic passing through middle hops remains encrypted in layers, preventing the node from inspecting or tampering with the underlying data.
• Flag Removal: If the node’s owner resolves the underlying configuration issues or proves the malicious behavior was a false positive, the Directory Authorities can remove the flag during subsequent voting cycles, restoring the relay’s full exit status.