What is DNS tunnelling?
DNS tunnelling is hiding data or commands inside DNS lookups, the queries every device makes to turn names into addresses. Because almost every network lets DNS through, attackers use it as a channel: data is encoded into long, random-looking subdomains of a domain they control, and their name server answers with instructions. It is slow, but it gets through firewalls that block everything else, and it is used both for command and control and for stealing data in small pieces. Signs are many unique, long subdomains under one domain, unusual record types such as TXT, and a host making far more DNS queries than normal. Forcing all devices to use your own resolvers and logging their queries makes it visible. NetSenX detects DNS tunnelling; it does not see lookups that devices send encrypted to resolvers outside your network.