Does NetSenX detect DNS tunnelling on every plan?
Yes. DNS tunnelling alerts are included on every plan, Free and Starter included. DNS tunnelling hides data or commands inside DNS lookups, usually as long, random-looking names sent to one domain. NetSenX alerts on that pattern. Other DNS-related detections are still being measured and do not raise alerts yet, so NetSenX does not claim to detect other kinds of DNS abuse. Independently of NetSenX, you can reduce the risk by sending all DNS through your own resolvers, blocking direct DNS to the internet from workstations, and keeping resolver logs. Remember that encrypted DNS sent over HTTPS to an outside provider is not visible as DNS to any network sensor.