What is DNS Tunneling?
DNS tunneling is a technique that hides arbitrary data inside ordinary-looking DNS queries and responses. Because DNS traffic is almost always allowed out of a network, attackers abuse it as a covert channel to exfiltrate data or run command-and-control — turning a protocol every network depends on into a quiet tunnel through the firewall.
What is DNS tunneling?
DNS tunneling is a technique for encoding data from another protocol inside DNS queries and responses, effectively using DNS as a hidden transport channel. Networks almost always permit outbound DNS so that name resolution works, and tunneling abuses that trust: the data rides along inside lookups that, to most controls, look like normal traffic.
How DNS tunneling works
A tunnel relies on the attacker controlling an authoritative server for a domain they own:
- A client-side program encodes the data it wants to send into the labels of a hostname, for example
encoded-data.tunnel.example.com. - The local resolver, doing its job, forwards that lookup until it reaches the attacker's authoritative server for the domain.
- That server decodes the data from the query and encodes any reply into the DNS response, often inside a TXT or NULL record.
- Repeating this exchange establishes a slow but functional two-way channel through the firewall.
The result is a covert link that does not require any direct connection between the client and the attacker's infrastructure.
Legitimate vs malicious uses
A handful of legitimate tools use DNS as a transport, such as some captive-portal and connectivity-check mechanisms. In practice, though, tunneling is overwhelmingly associated with abuse:
- Data exfiltration — sensitive files are chopped up, encoded into queries, and smuggled out a piece at a time, bypassing controls that watch other protocols.
- Command-and-control — malware on a compromised host receives instructions encoded in DNS responses, keeping a channel open even when other outbound traffic is blocked.
- Bypassing paywalls and filters — tunneling has also been used to evade captive portals and network usage restrictions.
Signs of DNS tunneling
- Unusual query volume — a single domain receiving far more lookups than any legitimate service would generate.
- Long, random-looking labels — hostnames packed with high-entropy strings rather than readable words.
- Rare record types — heavy use of TXT or NULL records, which carry more payload than a typical address lookup.
- High unique-subdomain ratio — almost every query targeting a different subdomain of the same parent.
How to mitigate DNS tunneling
- Inspect and log resolver traffic — collect DNS logs and analyze them for the volume, length, and entropy patterns above.
- Funnel DNS through approved resolvers — block direct outbound DNS from clients and force lookups through resolvers you control and can monitor.
- Apply threat intelligence and rate limits — block known tunneling domains and throttle abnormally chatty clients.
- Keep zones clean and observed — tunneling targets domains an attacker owns, but keeping your own zones tidy and monitored reduces the broader attack surface.
For the wider set of controls, see DNS security best practices.