What is DNS tunneling?

DNS tunneling is a technique where an attacker encodes data from other protocols inside DNS queries and responses. Because DNS traffic is allowed through almost all firewalls and is rarely inspected, it becomes a covert channel for stealing data or maintaining command-and-control access from inside a restricted network.

How can you detect DNS tunneling?

Look for unusually long DNS query names (over 50 characters), high volumes of DNS TXT or NULL record queries from a single host, unusual base32 or base64 encoded subdomains, and high entropy in query names. Security tools like Suricata, Zeek, and commercial DNS monitoring platforms can flag these patterns automatically.

Is DNS tunneling used by hackers?

Yes. DNS tunneling is used by advanced persistent threat (APT) groups and red-teamers. Tools like Iodine, dnscat2, and Cobalt Strike's DNS beacon use this technique. It has been observed in real-world breaches where attackers maintained persistent access by hiding their traffic in DNS queries.

Can DNS tunneling be blocked?

Yes. Organizations can block DNS tunneling by enforcing DNS to a monitored resolver, blocking direct DNS (port 53) to external servers, using DNS security monitoring tools that detect tunneling patterns, and blocking TXT/NULL record queries that are not from known internal services. Zero-trust DNS platforms and DNS firewalls can also prevent tunneling at scale.

DNS Tunneling Explained — How Attackers Hide Data in DNS Queries

DNS is the one protocol that flows through almost every firewall, proxy, and network security appliance on the internet. That universal reachability is what makes DNS tunneling one of the most effective covert channels for stealing data from inside restricted networks. Attackers encode arbitrary data inside DNS queries and responses, turning a simple name-resolution protocol into a full two-way communication channel.

This guide explains how DNS tunneling works at a technical level, how organizations detect and block it, and why DNS is an ideal transport for covert data exfiltration.

How DNS Tunneling Works

DNS tunneling operates by encoding data from another protocol (typically TCP/IP) as DNS query names and responses. The attacker controls both the client software on the compromised host and an authoritative nameserver for a domain they own.

The tunneling process

Step 1 — Encode data as subdomains: The client on the compromised machine takes a chunk of data to exfiltrate (for example, a stolen file) and encodes it as a DNS subdomain name. A 64-byte chunk of data might become a long string like aGVsbG8gd29ybGQ.aGVsbG8gd29ybGQ.attacker-example.com.

Step 2 — Query the attacker's domain: The encoded subdomain query is sent to a DNS resolver. Because it is a valid DNS query (just with an unusually long name), it passes through the firewall without inspection. The resolver forwards the query up the chain to the attacker's authoritative nameserver.

Step 3 — Authoritative nameserver decodes and responds: The attacker's nameserver receives the query, decodes the data from the subdomain, stores it, and encodes a response (such as a command or acknowledgement) as the DNS response data. DNS TXT records are commonly used for this because they allow up to 65KB of arbitrary text data per record.

Step 4 — Response travels back: The DNS response returns to the client via the normal DNS resolution path. The client decodes the response and executes any commands it contains. The attacker now has a bidirectional shell inside the network — all hidden within normal-looking DNS traffic.

Step 5 — Repeat: The process repeats rapidly, allowing the attacker to stream data out and receive commands in real time. DNS tunneling tools like Iodine, dnscat2, and Cobalt Strike's DNS beacon automate this entire flow.

Which DNS Records Are Used in Tunneling?

TXT records are the most popular tunneling transport. They allow up to 65KB of text data per record, making them ideal for high-bandwidth exfiltration. A single TXT response can carry a surprisingly large payload of encoded data.

CNAME records can also be used as a tunnel. The attacker creates a chain of CNAME records on their authoritative nameserver, each level carrying an encoded data chunk. While slower than TXT, this technique is less suspicious because many legitimate services use complex CNAME chains.

NULL records (RFC 3597) are another tunneling transport. NULL records have no defined purpose in the DNS specification, so most resolvers simply forward them without interpretation. This makes them harder to detect but also less widely supported — not all resolvers forward NULL records correctly.

A and AAAA records can be used as a low-bandwidth covert channel. The attacker encodes data in the IP address field — each response carries 4 bytes of data in an A record and 16 bytes in an AAAA record. This is slow but extremely stealthy because the queries look like normal DNS lookups.

Real-World DNS Tunneling Attacks

DNS tunneling is not theoretical. It has been used in real-world breaches by sophisticated threat actors:

In November 2020, the APT group known as OilRig used DNS tunneling to exfiltrate data from Middle Eastern organizations. The group deployed a custom DNS tunneling implant that encoded stolen data in TXT queries and maintained command-and-control access for months.

In 2022, researchers at Cisco Talos discovered a DNS tunneling campaign targeting financial institutions. The attackers used a modified version of the Iodine tool to maintain persistent access and exfiltrate data from internal networks behind strict corporate firewalls.

Red team engagements routinely use DNS tunneling as an initial access technique because it passes through most corporate network security without raising alerts. The technique works even when all internet access is restricted to a single internal DNS resolver.

How to Detect DNS Tunneling

DNS tunneling has detectable characteristics that distinguish it from legitimate DNS traffic:

Unusually long query names. Normal DNS queries are short — typically under 30 characters. Tunneling queries frequently exceed 50-80 characters because they carry encoded data in the subdomain. Any single query over 50 characters should be examined.

High volume of TXT queries. Most legitimate DNS traffic is overwhelmingly A and AAAA queries. If a host is generating a large number of TXT queries to an unusual domain, it is likely tunneling data through TXT records.

High entropy in query names. Legitimate domain names are human-readable. Tunneling subdomains contain base32 or base64 encoded data with high Shannon entropy. Security tools flag queries with entropy scores above 3.5 bits per character.

Periodic, consistent query patterns. DNS tunneling clients maintain a heartbeat interval, producing very regular query timing patterns. Legitimate DNS traffic is bursty and irregular.

Tools like Suricata, Zeek, and Palo Alto's DNS Security service can detect these patterns in real time. For home and small business users, the most practical defense is to block all external DNS on the network and force all queries through a monitored resolver that can flag anomalous patterns.

How to Block DNS Tunneling

Force all DNS through a monitored resolver. Use firewall rules to block outbound DNS (port 53 and port 853) to any IP other than your approved internal resolver. This ensures all DNS traffic passes through a resolver that can detect and block tunneling patterns.

Use DNS security monitoring. Deploy a DNS security service (such as Cisco Umbrella, Infoblox BloxOne, or Cloudflare Gateway) that inspects DNS query names for tunneling signatures, high entropy, and long subdomain labels.

Block known tunneling tools. Many commercial firewalls and endpoint detection tools now fingerprint common DNS tunneling tools (Iodine, dnscat2, DNSExfiltrator) by their query patterns and can block them automatically.

Implement DNS response policy zones (RPZ). An RPZ lets a DNS administrator define a policy that blocks queries to known malicious or suspicious domains. Some RPZ feeds specifically target domains used by DNS tunneling infrastructure.

Use encrypted DNS selectively. While DNS over HTTPS is excellent for privacy, it can also be used by malware to bypass your monitored resolver. On managed networks, you may want to block DoH to unapproved resolvers and force all DNS traffic through your local resolver. For individual users, DoH with a trusted resolver is the correct choice.

Legitimate Uses of DNS Tunneling

DNS tunneling is not always malicious. Security researchers use DNS tunneling tools to test network defenses during authorized penetration tests. VPN services sometimes offer DNS tunneling as a fallback protocol when VPN ports are blocked. Some developers use DNS as a channel for device registration in IoT environments where no other network is available.

The distinction between legitimate and malicious use comes down to authorization. Any DNS tunneling on your network that you did not set up and are not actively testing should be treated as compromised. Monitor DNS traffic, deploy detection tools, and investigate any unexpected TXT record patterns.