DNS tunneling: when data exfiltration looks like a lookup
Every DNS query carries text. A tunnel turns that text into an egress channel, and the result looks like a perfectly normal run of questions.
How the tunnel is built
The data to be taken out of the machine is encoded and split into pieces. Each piece becomes a domain name, something like one-piece-of-data.tunnel.example. The resolver answers as usual and the reply carries back what the other end wanted to say.
Because the address has the shape of an ordinary name, everything looks like a regular lookup. The server that receives the data and sends the answers sits on an ordinary domain and resolves normally. Tunnels work because DNS is allowed to carry text both ways, and very few people filter that path.
Why it goes unnoticed
The traffic looks like DNS, it goes to port 53 or to the address of a DNS-over-HTTPS server, and nobody looks. Even when the content of the query is inspected, what is inside is encrypted, which puts it beyond simple reading.
Volume helps hide it too: data exfiltration is usually small and spread over hours, mixed in with the normal traffic of the device. One query every ten seconds looks far less suspicious than a single large upload at one moment.
How to reduce the surface
Blocking the domains known to carry tunnels covers part of it, but those domain lists change constantly. Observing helps more: a device that asks for many names that do not exist, or that always queries the same domain with odd prefixes, is doing something different from the usual.
Two configuration choices make a difference. Restrict DNS egress so that only the chosen resolver can answer, and keep per-device query logs so the pattern becomes visible. It is the history, not the filter, that usually shows where the leak was going.