How can DNS tunneling be used for data exfiltration, and what is a basic method to detect it?

• A. DNS tunneling is used to deliver email
• B. DNS tunneling blocks DNS queries with TLS
• C. Attackers encode data in DNS queries; detect via high entropy subdomains, unusual DNS query patterns, large or frequent DNS TXT/CNAME records; monitor DNS logs and filter.
• D. DNS tunneling speeds up network traffic

Answer: (C)

DNS tunneling uses the DNS protocol as a covert channel to move data out of a network. An attacker encodes information into the labels of DNS queries (and sometimes the responses), sending them to a domain they control. Because DNS traffic is often allowed through firewalls and security devices, this channel can bypass normal network controls and gradually exfiltrate data without triggering typical detections. A basic way to spot this is by looking at DNS logs for unusually structured or high-entropy subdomains—labels that look like random strings rather than normal hostnames—and for odd query patterns, such as a large volume of small, frequent requests to a single domain or many TXT/CNAME lookups used to carry data. By monitoring DNS traffic, logging queries centrally, and applying filters or allow-lists to restrict DNS egress, you can detect and block such tunneling attempts.