What is DNS tunneling? How it works and how to stop it

DNS tunneling is a technique that hides data inside DNS traffic, the lookups computers make to turn domain names into IP addresses. Because almost every network lets DNS through, attackers use it to smuggle data out of a network or to control an infected computer without being noticed. You can spot DNS tunneling by unusual lookups, such as long, random-looking subdomains and large numbers of queries to one unknown domain, and you stop it by sending all DNS traffic through a single resolver that you can monitor and filter.

This article explains how a DNS tunnel works, what it is used for, how to detect it, how to prevent it and what to do when you suspect a DNS tunneling attack.

What is DNS tunneling?

DNS (Domain Name System) translates names like ljpc-hosting.nl into IP addresses. Your device asks a resolver, usually your ISP's DNS server. If the resolver does not know the answer, it asks the authoritative nameserver for that domain. How that chain works and what gets stored along the way is covered in what is DNS cache.

DNS tunneling abuses that chain as a covert channel. The query itself carries the message: instead of a normal hostname, the subdomain contains encoded data. The nameserver's response in turn carries commands or pieces of a file. The result is a two-way connection hidden in traffic that most firewalls treat as routine name lookups.

It works because DNS is allowed almost everywhere. No website or app works without it, so networks rarely block it, often not even before you have signed in to a Wi-Fi network. MITRE ATT&CK, the framework of attacker techniques used by security teams worldwide, lists DNS tunneling as an established command and control technique.

How does a DNS tunneling attack work?

A DNS tunnel needs two ends: a program on a device inside the network and a nameserver outside it that the attacker controls. In between, it works like this:

1. The attacker registers a domain, for example attacker.example, and points its NS records to a nameserver they run. Every query for that domain now ends up on their server, and they can read everything that arrives.
2. A program on an infected device encodes data as text that fits in a domain name, for example with base32 or hex encoding, and splits it into chunks.
3. Each chunk becomes a subdomain. The program looks up a name such as nnwgc3tumvxc4y3toy.0001.attacker.example. The first label is the encoded file name klanten.csv (Dutch for customers.csv).
4. The network's resolver does not know that name and forwards the query to the attacker's nameserver. Because every subdomain is new, nothing is cached and every query gets through.
5. The nameserver replies with data hidden in the answer, for example in a TXT record or in the IP address of an A or AAAA record. That is how the infected device receives its commands.

Each query carries little data: every label between two dots is at most 63 characters and the full name at most 255 bytes (RFC 1035). A tunnel therefore sends a long stream of queries and is slower than a normal connection. That is still fast enough for passwords, commands and documents.

What is DNS tunneling used for?

• Command and control. Malware asks for new commands over DNS and sends the results back. Palo Alto Networks Unit 42 reports that the espionage group OilRig has used DNS tunnels since at least 2016. The SUNBURST malware from the SolarWinds attack also communicated over DNS, and Cobalt Strike, an attack simulation tool that criminals abuse widely, can wrap its traffic in DNS.
• Data exfiltration. Stolen data leaves the network in chunks, as subdomains sent to the attacker's nameserver. In 2024 Unit 42 described campaigns that used this method against targets in finance and healthcare, among others.
• Bypassing network rules and paywalls. VPN services and open source tools such as iodine and dnscat2 route internet traffic through DNS. People use them to get around a workplace firewall or to get online on a plane or cruise ship without paying, according to Unit 42.
• Legitimate services. Not every tunnel is an attack. Security vendors use DNS for real-time checks of files and domains, and spam filters look up IP addresses in DNS-based blocklists. Those queries resemble a tunnel, so good detection keeps a list of what you allow on purpose.

How to detect DNS tunneling

You will not see a DNS tunnel on the computer or website itself. You see it in DNS traffic, so start with the logs of the place every query passes through: your own DNS server, firewall, router or a DNS filtering service. These are the signs to look for:

One sign on its own means little: a cloud storage client or antivirus program also makes many queries. The combination is what counts, for example an unknown domain that suddenly receives thousands of long, unique names from a single laptop.

Checking your own network

1. Turn on query logging on your DNS server, router or firewall, or use a DNS filtering service that keeps a log.
2. Count the unique subdomains requested per domain. Well-known services usually top the list; focus on domains you do not recognise.
3. For a suspicious domain, check the length of the names and the record types being requested.
4. Find the device that sends the queries (its IP address is in the log) and the program behind them.
5. Run dig NS attacker.example to see which nameserver the domain uses. How to use dig and nslookup is explained in troubleshoot DNS problems.

Larger networks use tools that do this for you, such as Zeek and Suricata, which record every DNS query and flag suspicious patterns with rules. Many business security suites also include DNS tunneling detection.

How to prevent DNS tunneling

Preventing DNS tunneling takes a combination of measures. The core idea: give DNS only one way out of your network, and make sure you can see and filter it.

1. Send all DNS through one resolver. Configure one DNS server for your network, your own or one you choose deliberately, and block outbound traffic on port 53 (UDP and TCP) and port 853 (DNS over TLS) to every other server. All lookups then pass one point you can log and filter, and malware cannot talk to its own DNS server outside your network.
2. Use a DNS filter that blocks malicious domains (protective DNS). Business services also detect tunnels: Cloudflare Gateway has a DNS Tunneling security category and Cisco Umbrella a DNS Tunneling VPN category, which you enable yourself. For a small office or at home, a filtering public resolver such as Quad9 is a good first step: it blocks known malware domains, although it will not catch every tunnel. Which services exist and how to set them up is covered in public DNS vs ISP DNS servers.
3. Control DNS over HTTPS. Browsers and apps can send DNS encrypted over HTTPS (DoH). That protects privacy, but it bypasses your own resolver, and malware uses it to hide DNS traffic too. On managed computers you set this with a policy: in Chrome and Edge with DnsOverHttpsMode (off, or only to your resolver with DnsOverHttpsTemplates), in Firefox with the DNSOverHTTPS policy.
4. Keep your DNS logs and review them regularly, or let your filtering service alert you about suspicious domains.
5. Stop the infection in the first place. A malicious tunnel starts with malware on a device or server. Keep systems, websites and plugins up to date, use two-factor authentication and run security software on your computers. For a WordPress site, update WordPress safely explains how.

DNS tunneling vs other DNS attacks

DNS tunneling is often confused with other DNS attacks. The difference: with tunneling, the attacker uses DNS as a hidden channel; in the other attacks, DNS itself is the target.

DNSSEC protects against forged answers, but not against tunneling: an attacker can sign their own domain as well.

What LJPc hosting takes care of

DNS tunneling mostly happens in the network where an infected device sits, such as your office or home network. For your website and domain at LJPc hosting, this is what we handle:

• A daily malware scan of your website. We scan the websites on our hosting servers every day. If we find files that may be malicious, you get an email listing the files and the type of malware we suspect, so you know quickly when something is on your site that does not belong there. In the customer portal, under My account > Notifications, choose in Malware alerts which email addresses receive that alert.
• Automatic DNSSEC for domains registered with us that use our nameservers, so visitors with a validating resolver are protected against forged answers.
• Help when you suspect something. If you see suspicious DNS traffic that seems to point to your website or server with us, create a support ticket and we will look into it with you.

Suspect DNS tunneling? What to do

1. Disconnect the device that sends the suspicious queries: unplug the cable and turn off Wi-Fi, so nothing else leaves the network.
2. Block the domain on your resolver or in your DNS filter, so other devices cannot reach it either.
3. Have the device investigated and cleaned by your IT administrator or a security specialist. Assume that passwords used on that device are compromised and change them from a clean device.
4. Is your website involved? Restore a clean backup or have the site cleaned, then change every password that belongs to the site. How to restore a backup is explained in back up your website.
5. Has personal data leaked? Then it may be a data breach. Under the GDPR, an organisation reports a breach to its data protection authority within 72 hours (in the Netherlands the Autoriteit Persoonsgegevens), unless it is unlikely to put the people involved at risk. Record it in your own breach register in any case.