Topic starter
19/08/2026 3:37 pm
TL;DR: DNS tunneling hides command-and-control and exfiltration inside allowed DNS traffic, and Wazuh shows how to detect it by correlating high-entropy queries, deep subdomains, and suspicious record types such as TXT or NULL, according to Wazuh. The security lesson is that DNS remains a blind spot when teams rely on perimeter allow-listing without behavioural inspection.
Editorial analysis by NHI Mgmt Group, based on content published by Wazuh: “Detecting DNS tunneling attacks with Wazuh”.
Key questions
Q: What fails when DNS traffic is only allow-listed instead of inspected?
A: Allow-listing alone fails when attackers hide encoded commands or data inside permitted DNS queries and responses.
Q: Why does DNS tunneling create command-and-control risk as well as exfiltration risk?
A: DNS tunneling can move both outbound data and inbound instructions through a channel that is normally trusted for name resolution.
Q: What are the signs that DNS tunneling detection is too weak?
A: Common signs include long random-looking subdomains, repeated queries to the same suspicious domain, excessive request volume from one host and unusual TXT or NULL records.
Practitioner guidance
- Inspect DNS for behavioural anomalies Monitor query entropy, label depth, frequency and record type together so detections reflect the full tunneling pattern rather than one noisy symptom.
- Capture DNS traffic at the endpoint Use host-level packet capture or equivalent telemetry on key systems so covert DNS activity is visible before it is flattened by upstream logging.
- Tune detection rules for compound indicators Require at least two suspicious DNS characteristics before raising a high-confidence alert, then prioritise the strongest combinations for triage.
Bottom line: DNS tunneling exploits the trust that many networks still place in permitted DNS traffic, which makes behavioural inspection essential.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:17 pm
DNS visibility is now a governance control, not just an operations concern. DNS is often treated as background infrastructure, but that assumption fails when the same channel can transport commands and data out of the environment. Security teams need to regard DNS inspection as part of detection governance, because blind trust in permitted traffic creates a standing concealment path for adversaries. The practitioner conclusion is simple: if DNS is not inspected behaviourally, it is not controlled.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should security teams balance DNS visibility with operational noise?
A: Treat DNS visibility as a layered control problem. Start with endpoint or network capture, normalise the fields you need for analysis, then use combined indicators to reduce false positives. The goal is not to alert on every odd lookup, but to identify the subset of DNS activity that looks like covert transport.
👉 Read our full editorial: DNS tunneling detection shows why DNS visibility still matters