Encrypted Traffic
Tor is agnostic to the data that is routed through the network. Data is protected as it traverses the network but not before it enters or after it leaves. It is the responsibility of the application to ensure that appropriate cryptography is used to ensure communications authenticity, integrity, and confidentiality. If the application is sending confidential or sensitive information in plaintext it is not fit for purpose and shouldn't be used at all.
DNS
DNS is a plaintext protocol, it cannot be encrypted. However you can route your DNS requests over Tor, unlinking your identity from the requests, by (in order of preference):
- Using SOCKS5 with remote hostname lookup.
- Using Tor's
DNSPort
.
Option 1 requires that the application supports this, many don't, and those that do often don't enforce it consistently.
Option 2 would require configuring Tor to listen on port 53/udp and setting your network configuration to explicitly use 127.0.0.1 as the resolver. This will cause all DNS requests for the system to be resolved through Tor and this may not be a good choice, as it could link together your activities on Tor with your activities outside of Tor. Not to mention Windows bizzaro chain of actions in it's attempt to resolve an address which isn't even consistent between updates, never mind versions of Windows. You may end up telling everyone on your network what you're trying to resolve. (hint: WINS/NetBIOS)
NEWNYM
NEWNYM signals are sent over Tor's ControlPort
(N.B. 9050 is normally the SOCKSPort
not the ControlPort
), requests are sent over a plain TCP connection (or UNIX socket), one to a line and each line terminated by a carriage-return and line-feed (although it seems tolerant to just a line-feed). First you must send an AUTHENTICATE
request, this may require some authentication data like a password or a cookie, depending on your configuration, then a SIGNAL NEWNYM
request.
There are various software packages like Stem
, txtorcon
, bulb
, and orc
which can talk the control port protocol.
The protocol is defined here, it's pretty straight forward and a few lines of python or whatever your preferred language is would be sufficient to create a script that would send the correct commands if you don't want to, or cannot, use the pre-existing libraries (I'm not sure how well they all support Windows, see my comments further down)
Multiple copies of Tor
Yes, it is perfectly fine to run multiple copies of Tor, each with different ports however they must also each use a different DataDirectory. You can also run a single copy of Tor with multiple ports configured. See the fine manual
SOCKSPort [address:]port|unix:path|auto [flags] [isolation flags]
Open this port to listen for connections from SOCKS-speaking applications. Set this to 0 if you don’t want to allow application connections via SOCKS. Set it to "auto" to have Tor pick a port for you. This directive can be specified multiple times to bind to multiple addresses/ports. (Default: 9050)
Windows
Outside of Tor Browser, there is very little tooling around Tor on Windows. Generally Windows is not considered a platform that is compatible with anonymity. It is closed source and relies on you trusting that isn't not going to betray you.
Outside of purely Windows issues, many applications are not suitable for use with Tor, they leak and they report identifying information about you, which even if anonymized on the network level by Tor, will still identify you. As such you should try to stick to using tools like Tor Browser which have been robustly designed to not leak or send identifying information.
In future, one question per question, please. This answer already feel needlessly long. It's called the Expert Bundle for a reason!