What are the signs that DNS tunnelling is bypassing normal controls?

How DNS tunnelling bypasses normal security controls

DNS tunnelling is a stealth channel, so the key control problem is not simply volume, it is whether DNS queries are being used to carry data or commands that should never be in name lookups. Watch for patterns that are technically valid DNS but operationally abnormal: long labels, encoded strings, bursty repetition and requests that do not fit the application’s usual domain footprint.

What abnormal DNS activity looks like in practice

Suspicious DNS tunnelling often shows up as lookups that are longer or more structured than ordinary host resolution, especially when the labels look algorithmic or base64-like. Another common clue is a high rate of repeated queries for subdomains under the same obscure parent, because the tunnel is splitting payloads into many small DNS transactions to move data or receive instructions.

Normal application DNS use tends to be repetitive in a predictable way, but tunneled traffic usually has poor alignment with user activity, service startup, or known application endpoints. That mismatch matters because defenders often tune DNS monitoring around outages and resolution failures, not around content abuse inside otherwise successful queries.

Why these signs matter to defenders

Once tunnelling is in place, DNS can become a low-friction path around web proxies, endpoint controls and content filters that focus on HTTP, SMTP or file transfer. The practical test is whether the DNS pattern is still explainable by the application stack, or whether it is acting like a covert transport layer that should be investigated as potential command-and-control or exfiltration.

DNS also creates a visibility gap because many environments log query metadata but do not inspect it deeply enough to spot encoded payloads or beaconing behaviour. If the traffic is destined for rarely used domains, rapidly changing subdomains, or external resolvers outside the expected path, the control failure is often one of detection and policy enforcement rather than basic packet blocking.

Risk and Threat Considerations

DNS tunnelling matters because it can hide both exfiltration and remote command traffic inside a protocol that is broadly permitted and often under-monitored. The result is not only stealth, but also delayed triage, since the activity can look like ordinary name resolution until the pattern is correlated across query length, repetition and destination reputation.

Failure mechanism: The tunnel splits data into DNS-sized chunks, encodes it into query names or responses, and sends those queries through a resolver path that normal perimeter controls are less likely to challenge.

Impact: Attackers may move data out of the environment or maintain command-and-control with less chance of immediate blocking, especially where DNS monitoring is shallow or exclusions are too broad.

Practitioner Guidance

What to verify: Compare suspicious DNS sessions against known application behaviour, including typical domain families, query length, frequency and the time windows in which the application legitimately uses DNS. A single odd lookup is weak evidence, but repeated long queries to the same obscure zone, especially from a host that should not talk outbound often, is much stronger.

What to measure: Track query length distribution, subdomain entropy, NXDOMAIN rates, resolver destination, and per-host query bursts so that anomaly review is based on baseline drift rather than intuition alone. If the pattern is consistent with tunnelling, investigate the host and resolver path together, because either side may reveal the control bypass.

Practitioner takeaway: Treat DNS tunnelling as a behaviour problem, not just a block-list problem, and prioritise baselining plus resolver visibility before relying on coarse filtering.

Related resources from NHI Mgmt Group

• What are the signs that a Bumblebee infection is bypassing normal endpoint controls?
• What are the signs that a SharePoint abuse campaign is bypassing normal email security controls?
• What are the signs that obfuscated malware is bypassing normal security controls?
• What are the signs that insider activity is bypassing normal monitoring controls?