DNS has to work for anything else to work, so it is almost never blocked - which makes it a perfect covert channel. Attackers smuggle stolen data and command-and-control traffic inside DNS queries themselves. Type a secret below, watch it get chunked into lookups, and see exactly which signals give it away.
Every DNS lookup for something.attacker.com eventually reaches the attacker's authoritative name server, because that is how recursive resolution works. The attacker owns attacker.com, so they receive the full query - including whatever they stuffed into the subdomain labels.
To exfiltrate, malware encodes the stolen data (hex or base32, since DNS names are restricted), splits it into chunks that fit in labels, and issues a lookup per chunk. To receive commands, it reads the answer records the attacker's server sends back. It is slow and chatty - but it flows straight through most egress controls, because blocking DNS breaks everything.
Tunnelling trades stealth of protocol for loudness of pattern. The same properties that carry data are the signals you hunt on, exactly the ones the lab above measures:
Label length & entropy: Real hostnames are short, pronounceable, and repeat (autodiscover, cdn). Encoded payloads are long and look random - high Shannon entropy. Alerting on labels over ~40 characters with high entropy catches most naive tunnels.
Volume & unique subdomains to one domain: A host making hundreds of lookups to a single second-level domain, each with a different high-entropy subdomain, is not normal browsing. That fan-out of unique names is the fingerprint.
Record types & domain reputation: Heavy use of TXT or NULL records (which carry more data) and queries to newly-registered or low-reputation domains raise the score further.
| Tool | What to hunt |
|---|---|
| NGFW | DNS labels > 40 chars with high entropy; high unique-subdomain count per domain; heavy TXT/NULL usage |
| SIEM | Per-host query volume to a single second-level domain over time; entropy scoring on qname |
| TIP | Reputation and age of the queried domain; known tunnelling toolmarks (iodine, dnscat2) |
The IRON CHIMNEY C2 domain is a close cousin of a DNS tunnel: a long, high-entropy label on a lookalike apex, queried on a timer from RESEARCH-STATION-01. Whether an attacker is beaconing or bulk-exfiltrating, the DNS tells on them the same way - unusual label shape, volume to one domain, and a freshly registered lookalike.
That is why the DNS resolver on SI-DC-01 is one of the richest hunting grounds in the environment. Combine label-shape scoring with domain reputation and you catch both the slow tunnel and the periodic beacon.