DNS Tunneling.

A covert channel that encodes arbitrary data inside DNS queries and responses on UDP/TCP port 53, frequently used for command-and-control and data exfiltration. It belongs to the Network Security category of cybersecurity.

A covert channel that encodes arbitrary data inside DNS queries and responses on UDP/TCP port 53, frequently used for command-and-control and data exfiltration.

DNS tunneling abuses the fact that DNS traffic (UDP/TCP port 53) is allowed almost everywhere and is rarely deeply inspected. Malware encodes payload bytes in subdomain labels (e.g., base32 chunks under attacker.example.com) and the attacker's authoritative server replies with TXT, CNAME, or NULL records containing the response or commands. Tooling like dnscat2, Iodine, or Cobalt Strike's DNS C2 use this pattern. Bandwidth is low but stealthy. Detection relies on high query rate per host, unusually long labels, high subdomain entropy, base64/hex patterns, atypical record types, and TI feeds. Defenses include DNS proxying, sinkholing, query rate limits, anomaly analytics in EDR/NDR, and blocking unknown DNS resolvers via egress firewall.

Defences for DNS Tunneling typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: DNS C2, DNS exfiltration.