DNS Tunneling Detected – What It Means & How to Stop It

Quick answer for advanced users

If you already know what DNS tunneling is and just need to stop it now: block all DNS queries to external resolvers except your own, monitor for high volumes of TXT or NULL record queries, and kill any process that's making more than 50 DNS lookups per minute to unknown domains. On Windows, use netsh to restrict outbound DNS to your internal server. On Linux, add iptables rules to drop port 53 traffic except from your DNS server.

What's actually happening here

DNS tunneling works because DNS queries are almost never blocked. Firewalls let UDP port 53 fly through. Attackers encode data – stolen passwords, database dumps, even full file transfers – inside DNS query strings or response payloads. Your DNS server logs show weird domains like base64encodeddata.evilsite.com. The reason this works so well is that DNS is designed to be a low-level protocol that almost every machine trusts. The attacker sets up a malicious DNS server that decodes the tunneled data. The victim machine sends DNS queries that look legit but carry stolen info in the subdomain names.

I've seen this happen in real setups: an infected Windows 10 workstation with a keylogger exfiltrating keystrokes via DNS every 30 seconds. The logs showed thousands of TYPE NULL queries to a single domain. Another case was a compromised Linux web server sending database credentials via TXT record queries. The common trigger is a machine that's been hit with a dropper – often through a phishing email or a drive-by download – that installs a small tunneling client like dnscat2 or iodine.

Numbered fix steps

1. Identify the infected machine. Check your firewall or DNS server logs for domains with long subdomain names (over 50 characters) or repeated queries to unknown domains. On Windows, run netstat -ano | findstr :53 to see which process is making DNS queries. Note the PID, then check it in Task Manager.
2. Kill the malicious process. On Windows, use taskkill /PID /F. On Linux, kill -9 . If the process respawns, you've got a persistent infection – run a full malware scan.
3. Block outbound DNS to external servers. On Windows, run this as admin: netsh advfirewall firewall add rule name="Block DNS Out" dir=out protocol=udp localport=53 action=block. Then allow only your internal DNS server: netsh advfirewall firewall add rule name="Allow Internal DNS" dir=out protocol=udp remoteip=192.168.1.1 localport=53 action=allow. Replace 192.168.1.1 with your real DNS server IP. On Linux, iptables is your friend: iptables -A OUTPUT -p udp --dport 53 -d ! 192.168.1.1 -j DROP.
4. Clear DNS cache. On Windows: ipconfig /flushdns. On Linux: sudo systemd-resolve --flush-caches or restart your DNS resolver.
5. Disable direct DNS in client apps. Some software (like VPN clients or custom scripts) bypass the system DNS and query external resolvers directly. Check your running services for anything unusual. Disable any you don't need.

Alternative fix if the main one fails

If the tunneling keeps happening even after steps above, the attacker might be using DNS over HTTPS (DoH) to hide traffic. DoH uses port 443, so port 53 blocking won't stop it. Here's what to do:

1. Block known DoH endpoints. In your firewall, block these IP ranges and domains: Cloudflare's 1.1.1.1, Google's 8.8.8.8, Quad9's 9.9.9.9, and their subdomains (cloudflare-dns.com, dns.google, etc.).
2. Use a proxy or DNS filter. Run a DNS sinkhole like Pi-hole on the network. Point all clients to it. Pi-hole can log and block queries to known tunneling domains. It's not perfect but catches a lot.
3. Check for DNS tunneling tools in memory. On Linux, run ps aux | grep -E 'dnscat|iodine|dns2tcp'. On Windows, use tasklist | findstr /i dnscat. If found, remove them with your AV or manually delete the binary.

Prevention tip

DNS tunneling is a symptom of a bigger problem: an attacker already inside your network. The real prevention is limiting what can talk to the internet in the first place. Use a network firewall that only allows DNS traffic to your internal DNS server. Log all DNS queries and monitor for anomalies – high frequency of TXT or NULL record types to a single domain is a dead giveaway. Also, keep your machines patched. A lot of tunneling malware comes through unpatched software. I've seen it enter via a vulnerable PDF reader on Windows 10. Update everything, not just the OS.

If you're on a budget, run a Pi-hole with a blocklist for known tunneling domains. It won't stop a custom tunnel, but it'll stop 90% of the common tools. The rest depends on good firewall rules.