Attacks and malware
What is DNS tunneling?
Hiding data or C2 traffic inside DNS queries and responses, which are often allowed out of networks without inspection.
DNS tunnelling encodes data inside DNS queries and answers, for example as long random-looking subdomains of a domain the attacker controls. Because DNS is needed everywhere and is often not inspected, it can carry C2 commands or exfiltrated data out of restrictive networks.
Signs include unusually long query names, high volumes of queries to one domain, many unique subdomains and TXT record lookups that do not fit normal use.