Support Library
DNS Tunneling (Data Exfiltration)
How DNS tunneling hides data in queries to an attacker-controlled domain, the signs to look for in resolver logs, and how to block it.
The short answer
DNS tunneling hides other data inside DNS queries and answers. Malware on an inside machine encodes data in the labels of names under a domain the attacker controls, such as MZXW6YTBOI.x7.attacker.example. The local resolver dutifully forwards the query to the attacker's authoritative server, which decodes it and replies with commands in TXT, NULL or CNAME records. Because almost every network lets DNS out, the channel works even where direct internet access is blocked.
It is a problem for the network where the infected machine sits, not for the domain being queried. It says nothing about your own zone's configuration.
Signs to look for
| Signal | Why it stands out |
|---|---|
| Long, random-looking labels | Encoded data has high entropy and fills labels close to the 63-character limit |
| Many unique subdomains of one domain | Each chunk of data is a new name, so the cache never helps |
| High query volume from one client to one domain | Normal browsing spreads across many domains |
| Unusual record types | Lots of TXT, NULL or large CNAME answers from a domain with no business reason for them |
| Queries that bypass your resolver | Clients talking straight to outside DNS servers, or using DoH to an unapproved resolver |
| Newly registered or rarely seen domains | Tunnel domains are often fresh |
Malware that uses domain generation algorithms (DGAs) produces a different but related pattern: many NXDOMAIN answers for random names in many domains.
Defences
- Force all DNS through resolvers you control, and block outbound port 53, 853 and known DoH endpoints for everything else.
- Log queries at those resolvers and look for the signals above; most security analytics tools have tunneling detections.
- Use a protective DNS service or a DNS firewall (RPZ) to block known tunneling and malware domains.
- Limit which internal hosts may resolve external names at all; servers often do not need to.
How DNS Panopticon helps
DNS Panopticon does not see your network's DNS traffic, so it cannot detect tunneling. If you find a suspicious domain in your logs, Website Recon shows its registration date, registrar and name servers, which helps judge whether it is new and unknown, and checks it against public blocklists.