DNS tunnelling is a covert technique that hides data inside DNS queries and responses to move information through a network. Attackers can abuse a protocol that is often allowed through firewalls, using encoded DNS traffic for command and control, data exfiltration, or bypassing security controls.
What DNS Tunnelling Is Used For
DNS tunnelling turns DNS, a protocol most networks must allow, into a covert transport channel. That makes it useful for command and control, data exfiltration, and other traffic that needs to blend into ordinary name resolution.
Because DNS is foundational to internet connectivity, attackers often exploit the trust defenders place in resolver traffic and recursive lookups. When a tunnel is active, the apparent “normal” DNS activity can hide a much less normal payload pattern.
How DNS Tunnelling Works
The technique usually encodes data into subdomains, query labels, or responses so the DNS conversation carries more than name resolution. The attacker controls both ends of the exchange, with one side sending information out and the other reconstructing it from the DNS exchange.
In practice, the tunnel may use high query volume, unusual label lengths, repetitive domains, or seemingly random hostnames. Those patterns matter because they create observable structure even when the content is obfuscated.
Why DNS Tunnelling Is Hard To Spot
DNS traffic is often permitted across firewalls and security appliances because business services depend on it. That creates an ideal cover path for covert communication, especially in environments where the defender inspects ports but not payload patterns or resolver behaviour.
The defensive challenge is that the channel can resemble ordinary lookups unless an organisation watches for anomalies such as rare domains, excessive NXDOMAIN responses, or long, encoded-looking queries. DNS Security Guide is a useful companion for understanding the broader controls that reduce this kind of abuse.
Detection, Containment, And Defensive Controls
Effective detection usually combines DNS logging, resolver telemetry, and egress filtering with threat-hunting logic that looks for tunnelling patterns rather than just known bad domains. For example, dns analytics can help reveal beacon-like behaviour even when the payload itself is hidden.
Containment typically means limiting which systems may resolve external names, enforcing approved resolvers, and blocking direct-to-internet DNS where possible. Command and Control (C2) Guide is relevant because DNS tunnelling is frequently used as a C2 transport, and the same monitoring logic can surface both threats.
For protocol governance and authoritative naming context, IANA is a useful reference point for the DNS ecosystem and related registries.
Risk and Threat Considerations
DNS tunnelling is risky because it turns a core internet dependency into a covert pathway for attacker communication, data theft, or control-channel persistence. Its value to an adversary comes from the fact that many environments treat DNS as necessary background traffic rather than a high-risk egress path.
Failure mechanism: If DNS queries are insufficiently monitored or unrestricted to untrusted resolvers, encoded traffic can evade perimeter controls and continue operating even after other outbound channels are blocked.
Impact: The result can be data exfiltration, remote command execution, slower incident detection, and a durable channel for staging or maintaining compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0011 — Command and Control | DNS tunnelling is a common adversary C2 transport path. |
| T1071.004 — Application Layer Protocol: DNS | DNS tunnelling abuses DNS as an application-layer covert channel. | |
| Recommendation — Map suspicious DNS patterns to C2 activity and hunt for beaconing, staging, and exfiltration signals. Detect DNS-based covert channels by correlating query structure, volume, and domain rarity. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | DNS tunnelling exploits weak control of network boundaries and egress paths. |
| AU-12 — Audit Record Generation | DNS tunnelling detection depends on retaining resolver and network audit data. | |
| Recommendation — Restrict and monitor DNS egress paths so only approved resolvers and flows are permitted. Enable DNS and network audit logging so anomalous query patterns can be investigated. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | DNS tunnelling is best managed by controlling resolver use and network egress behaviour. |
| Recommendation — Consolidate DNS resolution through approved infrastructure and block unauthorized DNS paths. | ||
Related resources from NHI Mgmt Group
- Why do domain hijacking and DNS tunnelling create outsized risk for business continuity?
- What are the signs that DNS tunnelling is bypassing normal controls?
- What are the signs that DNS tunnelling is being used for command and control?
- How do you detect DNS tunnelling and exfiltration tools on Windows?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org