How do I protect against DNS Tunneling and data exfiltration through my network?

All answers to this question.

DNS Tunneling is a favorite for attackers because port 53 is almost always open. You need to look for "Entropy" in your DNS queries. Normal queries look like "https://www.google.com/search?q=google.com," but tunneling queries often look like long, random strings of characters as subdomains (e.g., "https://www.google.com/search?q=a1b2c3d4.malicious-domain.com"). Tools like Cisco Umbrella or Infoblox are designed specifically to analyze these patterns. You should also restrict your internal clients so they can only talk to your internal DNS server, which then forwards to a secure, filtered upstream provider like Cloudflare (1.1.1.1) or Quad9.

   Answered 2025-11-10 by Susan Nelson

Have you tried setting a threshold for the size of DNS packets? Tunneling often involves unusually large TXT records or null records.

   Answered 2025-11-12 by Daniel Roberts

• Great point. Monitoring packet size is a solid "low-tech" way to catch basic tools like Iodine or DNScat2. However, more advanced attackers use many small packets to stay under the radar. That's why "Query Volume" per source IP is a better metric. If one workstation is making 50,000 DNS requests an hour, it’s a red flag. You should also enable DNSSEC to ensure the integrity of the responses your servers are receiving.

     Commented 2025-11-15 by Richard Lewis

Use an EDR (Endpoint Detection and Response) tool on your servers. It can often see the process that is generating the DNS traffic and kill it before the data leaves.

   Answered 2025-11-17 by Barbara King

• EDR adds that "host-based" visibility that the network firewall lacks. Combining network logs with endpoint data is the only way to get the full picture.

     Commented 2025-11-19 by Charles Baker