Domain Name System traffic is the DNS request and response data that flows between clients, resolvers, and authoritative servers. It carries hostname lookups, record types, and cache responses over UDP or TCP, usually on port 53, and can be monitored, filtered, or spoofed as part of network security controls.
DNS traffic as a security signal
DNS traffic is more than name resolution. Because every lookup reveals a client, a queried name, and a response path, it becomes one of the richest network signals for understanding what systems are trying to reach, whether resolution is working as expected, and whether the organisation is seeing normal or suspicious name activity.
In practice, DNS can expose infrastructure dependencies that are otherwise hidden behind IP churn, load balancers, and content delivery layers. It is also a common place to apply defensive controls, including filtering, sinkholing, logging, and reputation-based blocking, because those controls can interrupt malicious resolution before a connection is made.
How DNS traffic behaves on the wire
Most DNS traffic uses UDP for low-latency queries, with TCP appearing for larger responses, zone transfers, truncation handling, or when reliability matters. That protocol split matters operationally because some tools observe only one transport and miss part of the picture. DNS responses also carry TTL values and cache behaviour, which influence how long clients continue using a result even after the source of truth has changed.
Modern environments may also carry DNS over HTTPS or DNS over TLS, which changes where inspection and policy enforcement can occur. That does not make the traffic less important, but it does shift visibility from simple port-based monitoring toward resolver policy, endpoint controls, and upstream logging.
Why DNS traffic is useful for defence
DNS is a natural control point because many attack paths depend on successful resolution before exploitation or command-and-control can happen. Monitoring query patterns can help defenders identify newly registered domains, fast-changing infrastructure, tunnelling behaviour, and suspicious lookups that do not match user or application activity.
DNS telemetry is also valuable for incident response because it helps reconstruct what a host tried to reach before, during, and after compromise. When paired with proxy, endpoint, and firewall data, it can show whether a system contacted malicious infrastructure, whether a sinkhole intercepted the request, and whether other hosts show the same pattern.
For broad DNS operations and defensive patterns, the DNS Security Guide covers protective DNS, DNSSEC, tunnelling, logging, and related controls. For defenders who want to map network behaviour to defensive techniques, the MITRE D3FEND Guide is useful for connecting DNS monitoring and filtering to detection and countermeasure design.
Common attack and abuse patterns in DNS traffic
DNS traffic is attractive to attackers because it is ubiquitous and often trusted. Spoofed responses, cache poisoning, malicious zone transfers, subdomain abuse, and DNS tunnelling can all exploit the fact that many environments treat DNS as routine background traffic rather than a high-value control plane.
Attackers also use DNS to hide in plain sight. High-volume or unusual query sequences can carry exfiltration, beaconing, or fallback behaviour, while malicious domains can be rotated quickly to reduce block effectiveness. That is why DNS reputation, allowlisting, and response policy zones are often stronger when combined with endpoint and resolver-side detection.
Operational monitoring and response for DNS traffic
Effective monitoring starts with resolver inventory and visibility into where DNS is actually being generated and answered. Teams should know which resolvers are authoritative for policy, which clients bypass them, and whether encrypted DNS or shadow resolvers are creating blind spots. The IANA registries are useful when teams need an authoritative reference for ports, protocols, and identifiers that shape DNS handling.
Response usually focuses on containment, then validation. If suspicious DNS activity is confirmed, defenders commonly block the domain, sinkhole it where appropriate, look for related internal hosts, and review cached answers, logs, and upstream resolver behaviour for signs of persistence or repeated contact. After that, they check whether the DNS layer was merely noisy or part of a broader compromise path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1071.004 — Application Layer Protocol: DNS | DNS traffic is a common channel for command-and-control and tunnelling. |
| T1095 — Non-Application Layer Protocol | DNS can be abused for non-standard data transfer and covert communication. | |
| Recommendation — Detect DNS-based C2 patterns and investigate unusual query volume or domain churn. Inspect anomalous DNS payloads and block covert traffic patterns. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | DNS traffic monitoring is a core detection and visibility control for suspicious activity. |
| SC-20 — Secure Name / Address Resolution Service (Authoritative Source or Resolver Cache) | DNS traffic is directly governed by secure name resolution controls and resolver trust. | |
| AU-12 — Audit Record Generation | DNS logs are audit records that support investigation and incident reconstruction. | |
| Recommendation — Correlate DNS telemetry with host and network events to identify malicious resolution. Use secure resolver controls and trusted sources to reduce spoofing and poisoning risk. Log DNS queries and responses with enough context to support response and forensics. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org