DNS TXT exfiltration is a method of stealing data by encoding it into DNS text record queries and responses. It can evade monitoring that focuses on web traffic because DNS is often broadly allowed and small query fragments are easy to overlook.
Expanded Definition
DNS TXT exfiltration is a covert data-theft technique that abuses the DNS protocol by placing stolen content into TXT record queries or responses. In NHI and agentic environments, it is often used when a compromised agent, service account, or workload can make outbound DNS requests but has limited direct internet access. The technique matters because DNS is commonly permitted across networks, monitored less rigorously than HTTP, and can blend into ordinary resolver activity. In practice, exfiltration is usually chunked into small fragments, encoded, and distributed across many lookups to avoid triggering simple size or anomaly thresholds. NHI Management Group treats this as a data movement problem as much as a protocol abuse problem, because the real control gap is often excessive egress trust around identities that should only query approved destinations. Definitions vary across vendors on whether DNS tunneling, DNS covert channels, and TXT exfiltration are separate categories or overlapping patterns; no single standard governs this yet. The most common misapplication is treating all DNS traffic as low risk, which occurs when security teams inspect only web proxies and ignore resolver logs or recursive DNS patterns.
For protocol context, see RFC 1035 and the broader detection and response framing in the NIST Cybersecurity Framework 2.0.
Examples and Use Cases
Implementing DNS monitoring rigorously often introduces some operational noise, requiring organisations to weigh higher detection fidelity against the cost of tuning legitimate resolver traffic and short-lived service lookups.
- A compromised CI/CD runner encodes API key fragments into TXT queries sent to an external domain controlled by the attacker.
- An abused agent uses DNS because direct HTTPS egress is blocked, but recursive DNS is still allowed from the subnet.
- A service account with excessive privileges reads a secret, then breaks it into multiple DNS queries to evade content inspection.
- A threat actor hides small configuration dumps inside TXT responses by abusing an attacker-controlled authoritative DNS zone.
- A blue team correlates unusual query volume with identity activity after reviewing guidance from the Ultimate Guide to NHIs and maps the behavior to DNS record handling in RFC 1035.
Operationally, this pattern often appears alongside tooling that was never intended to move sensitive data, including scripts, agents, and automation jobs that can reach DNS but not other protocols. Security teams also use the Ultimate Guide to NHIs to understand why overprivileged machine identities are so often the initial foothold for covert exfiltration.
Why It Matters in NHI Security
DNS TXT exfiltration becomes especially dangerous when machine identities have broad outbound reach, because the protocol itself provides a ready-made channel for hiding stolen secrets, tokens, and configuration data. NHI Management Group has observed that only 5.7% of organisations have full visibility into their service accounts, while 97% of NHIs carry excessive privileges, conditions that make covert data movement much harder to detect and contain. The issue is not just network monitoring, but governance over which NHIs may query external resolvers, what data they can access, and how quickly compromised credentials can be revoked. This maps directly to least-privilege and egress control expectations in the NIST Cybersecurity Framework 2.0, because detection alone does not stop a machine identity that should never have had the data in the first place. Organisations that ignore DNS abuse often discover the problem only after a secrets leak, at which point DNS TXT exfiltration becomes operationally unavoidable to investigate and contain.
The operational lesson from the Ultimate Guide to NHIs is that excessive access and poor visibility turn ordinary infrastructure protocols into exfiltration paths, especially when secrets are already exposed in code, config, or CI/CD tooling.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-06 | Covers anomalous NHI behavior and abuse of machine identities for data theft. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access reduces the data available for covert exfiltration. |
| NIST Zero Trust (SP 800-207) | 5.2 | Zero Trust requires continuous validation of identity and session trust before data movement. |
| NIST AI RMF | AI systems need mapping of data flows and misuse detection across indirect channels. | |
| OWASP Agentic AI Top 10 | A3 | Agent tool and action abuse can be used to move data outside intended channels. |
Limit outbound DNS reach for NHIs and alert on unusual query volume, encoding, or destination patterns.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
