# Can data be stolen through DNS without anyone noticing?

Yes, if nobody looks at DNS. Data leaving through DNS lookups does not show up as a large upload, because each query carries only a few dozen bytes, and many firewalls allow DNS without inspection. It shows up in the pattern: one host sending thousands of queries to subdomains of the same unfamiliar domain, with long, random-looking names that are never repeated, often at a steady rate. To make it visible, let devices use only your own DNS resolvers, block direct DNS to the internet at the firewall, keep resolver logs, and review domains with unusually many unique subdomains. DNS filtering services add blocklists of known tunnelling domains. NetSenX detects DNS tunnelling on monitored segments; other DNS-based techniques, such as algorithmically generated domains, are not part of what it alerts on today.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/can-data-be-stolen-through-dns-without-anyone-noticing

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [Can malware hide in DNS over HTTPS, and can we still see it?](https://netsenx.com/en/faq/can-malware-hide-in-dns-over-https)
- [What is low-and-slow data exfiltration, and how is it detected?](https://netsenx.com/en/faq/what-is-low-and-slow-data-exfiltration)
- [Why do simple bandwidth alarms miss data theft?](https://netsenx.com/en/faq/why-do-bandwidth-alarms-miss-data-theft)
- [What does Cobalt Strike activity look like on the network?](https://netsenx.com/en/faq/what-does-cobalt-strike-look-like-on-the-network)
- [Is internal port scanning a sign of an intruder?](https://netsenx.com/en/faq/is-internal-port-scanning-a-sign-of-an-intruder)