DNS Tunneling Alert: Stop Data Theft in 5 Steps

Quick answer for advanced users

Disconnect the infected machine from the network. Run a full malware scan with an up-to-date antivirus. Check your DNS logs for unusual queries to unknown domains. Block the malicious domain at your firewall. Then change all passwords for accounts accessed from that machine.

What DNS tunneling actually is

DNS tunneling sounds technical, but the idea is simple. Your computer makes DNS queries every time you visit a website. That's normal. Attackers figured out they can hide stolen data inside those queries. For example, instead of asking for google.com, the malware asks for stolendata123.malicious-domain.com. That part before the real domain — stolendata123 — can be a piece of your credit card number, a password, or a file chunk.

Your security tool (like an IDS or endpoint protection) picked up on this pattern. It saw a ton of DNS requests to a domain your computer never normally talks to. Or the requests were way too long. Or they happened way too fast. That's the alert you're seeing now.

This is common in targeted attacks. A user clicks a bad link in an email. The malware installs quietly. It then starts sending data out slowly, piece by piece, inside DNS queries. Because DNS traffic is usually allowed through firewalls, the data gets out without being stopped. The real fix is not just removing the malware — it's also securing your DNS infrastructure so it can't happen again.

Step-by-step fix

1. Isolate the infected machine. Unplug the network cable or turn off Wi-Fi immediately. Don't shut the computer down yet — you want to capture the malware in memory if possible. But you must cut its connection. After pulling the plug, you should see the security alerts stop or at least slow down.
2. Capture DNS logs from your security tool. Go to your DNS server or security dashboard. Export the last 24 hours of DNS query logs. Look for a domain that shows up hundreds or thousands of times. That domain is the tunnel's endpoint. Write down that domain name. You'll need it for the firewall block later.
3. Run a full offline malware scan. Boot the infected machine from a clean USB with an antivirus scanner on it. I use Microsoft Defender Offline or Kaspersky Rescue Disk. Let it scan the whole drive. It will likely find a trojan or a backdoor. Delete everything it flags. After the scan, you should see no more suspicious processes in Task Manager.
4. Block the malicious domain at your firewall. Go to your firewall rules. Add a DNS filter or a domain block rule for the domain you found in step 2. Also block its IP address if you can get it. This stops any other machines on your network from reaching the same command server. After applying the rule, try to resolve that domain from a test machine — it should fail.
5. Change all passwords used on that machine. The attacker likely stole credentials. Change passwords for email, banking, corporate systems, and any saved logins. Use a different, clean computer to do this. After you change the passwords, log out of all active sessions on every service. That kicks the attacker out if they were still logged in.

Alternative fixes if the main steps don't work

Sometimes the malware is stubborn. The scan misses it, or it re-infects itself. Try these.

Restore from a backup taken before the infection

If you have a system backup from a week or more ago, restore the machine from that. But only if you're sure the backup is clean. After the restore, immediately update your antivirus and run a scan anyway.

Use a DNS filtering service

Services like Quad9 (9.9.9.9) or OpenDNS block known malicious domains automatically. Change your network's DNS settings to point to them. This won't clean an infected machine, but it'll stop the data from leaving your network. After changing the DNS, test by visiting a site you know is safe — it should still work.

Reinstall the operating system from scratch

When nothing else works, nuke it. Back up personal files to an external drive (scan them first on a clean computer). Then do a full Windows or Linux reinstall. This is the nuclear option, but it guarantees the malware is gone. After the reinstall, don't restore any program files — only documents, photos, and other data.

Prevention tip that actually works

The single best thing you can do is monitor your DNS traffic. Set up a tool like Pi-hole, Security Onion, or even a simple script that logs all DNS queries. Look for patterns: a domain that gets queried every 5 minutes, with long weird subdomains, is a red flag. Also block all outbound DNS traffic except to your own DNS server. That prevents malware from using its own hardcoded DNS servers. And train your users not to click links in email from people they don't know. That's how most of this stuff gets in.

Also — patch your systems. DNS tunneling tools like dnscat2 and Iodine are old news. But attackers keep using them because people leave old software unpatched. If you're on Windows, enable automatic updates. On Linux, set up unattended-upgrades. The less work you give attackers, the better.

Real-world example: In 2021, a healthcare company had DNS tunneling for months. The security tool alerted daily, but no one checked the logs. The attackers stole patient records. It only stopped when they changed their DNS server to Quad9. Don't be that company. Check the alerts.