Can data be stolen through DNS without anyone noticing?
Yes, if nobody looks at DNS. Data leaving through DNS lookups does not show up as a large upload, because each query carries only a few dozen bytes, and many firewalls allow DNS without inspection. It shows up in the pattern: one host sending thousands of queries to subdomains of the same unfamiliar domain, with long, random-looking names that are never repeated, often at a steady rate. To make it visible, let devices use only your own DNS resolvers, block direct DNS to the internet at the firewall, keep resolver logs, and review domains with unusually many unique subdomains. DNS filtering services add blocklists of known tunnelling domains. NetSenX detects DNS tunnelling on monitored segments; other DNS-based techniques, such as algorithmically generated domains, are not part of what it alerts on today.