What Is DNS Tunneling? How to Detect and Prevent It

DNS tunneling is an attack technique in which the attacker encodes data inside DNS queries and responses, using them to smuggle information out of a corporate network or carry commands into it. Because DNS traffic is allowed on virtually every network, tunneling slips past firewalls disguised as legitimate queries. Left undetected, it can run for months and is one of the quietest paths for data exfiltration.

How does DNS tunneling work?

The core idea is simple: the DNS query itself becomes a data carrier.

1. The attacker runs the authoritative DNS server for a domain under their control — say, `attacker-example.com`.
2. A compromised device inside the organization splits the data it wants to exfiltrate into small chunks and encodes each chunk as a subdomain: something like `c2FsxYFyaQ.attacker-example.com`.
3. These queries travel through the organization's DNS server along the normal resolution chain and arrive at the attacker's server, where each data chunk is recorded.
4. The attacker encodes commands for the device inside DNS responses — TXT records, for example — establishing a channel in the reverse direction as well.

The result is a two-way communication channel that opens no unusual ports and runs entirely over DNS. Ransomware operations actively use this channel for data exfiltration and command-and-control (C2) traffic.

What are the signs of DNS tunneling?

Tunneling traffic differs statistically from normal DNS traffic. The main signals to watch:

• Abnormally long query names: Data-carrying subdomains are noticeably longer than normal queries and contain random-looking character strings.
• High query volume to a single domain: A domain that would normally be resolved a handful of times suddenly receives hundreds of unique subdomain queries per minute.
• Increased use of TXT and NULL records: These record types can carry large data blocks, which makes them the tool of choice for tunneling software.
• Regularity in query timing: Fixed-interval (beacon) query patterns that do not resemble human behavior.
• High entropy: Character distributions in query names that drift far from natural language.

None of these signals is conclusive on its own; reliable detection requires analysis that looks at query behavior as a whole.

How is DNS tunneling detected?

Signature-based detection

Patterns produced by known tunneling tools, and known tunnel domains, are blocked with threat intelligence. This is fast — but it falls short the moment the attacker changes tools or domains.

Behavior-based detection

Query length, entropy, subdomain diversity, record type distribution and timing are evaluated together to build a risk profile for each domain. This approach can catch tunneling infrastructure that has never been seen before. It belongs to the same family as DGA detection: both look for behavior, not signatures.

AI-assisted classification

Machine learning models are better than rule-based systems at separating "looks like tunneling but is harmless" patterns — legitimate CDN and telemetry traffic, for example — from the real thing, which drives down false positives. Running the model on-premise also removes any need to send query data outside the organization for analysis.

How is DNS tunneling prevented?

• Route DNS traffic through a single point: Block clients from reaching external DNS servers (such as 8.8.8.8) directly at the firewall, so every query passes through the organization's DNS layer. Unmonitored DNS egress is an open door for tunneling.
• Log DNS queries and map them to users: Incident response is impossible without knowing which user a query came from. This is why Active Directory mapping is critical.
• Run behavioral analysis at the DNS layer: Tunneling is visible at the DNS layer, not the network layer. The analysis must see queries in real time.
• Block suspicious domains instantly: Blocking a detected tunnel domain across the whole organization and every branch at once shuts the channel down in a single move.
• Forward verdicts to the SIEM: A tunneling detection should trigger an incident response process; isolating and cleaning the device is the follow-up to the DNS block.

You can see how detection and blocking work end to end at the DNS layer in how Obsolix works.

Frequently asked questions

Is DNS tunneling only used for data exfiltration?

No. Beyond exfiltration, it is used for command-and-control traffic, internet access on restricted networks, and delivering malware updates.

Why can't a firewall catch DNS tunneling?

A firewall allows DNS traffic because it is valid at the protocol level; it has no context for evaluating the statistical anomaly inside the queries. Detection requires a layer that analyzes DNS queries as a whole.

Does encrypted DNS (DoH/DoT) prevent tunneling?

No — on the contrary, encrypted DNS can reduce the organization's visibility and make tunneling harder to notice. On corporate networks, control client access to external DoH servers and keep resolution flowing through a layer the organization controls.