thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

DNS Tunneling

Encoding data or command-and-control traffic inside DNS queries and responses to bypass network controls.

Definition

Because DNS is usually allowed outbound, attackers encode data in subdomain labels and TXT or other record responses to an authoritative server they control. Tools such as iodine and dnscat2 implement it. Indicators include long, high-entropy subdomains, high query volume to one domain and unusual record types.

Example

Queries like 4a6f686e2e646f65.exfil.attacker.com carrying hex-encoded data.

Exam tip

Long random subdomains to a single domain indicate DNS tunneling, a covert channel for C2 or exfiltration.

Related terms