DNS: The Exfiltration Channel Your SOC Is Not Watching
8 gigabytes of sensitive data left your network last quarter.
Not through HTTP. Not through email. Not through VPN.
Through DNS queries.
Each query carried 63 bytes of encoded payload. Nobody flagged it. Your firewall saw DNS. Your SIEM saw DNS. Neither one was looking.
HOW DNS TUNNELING WORKS
DNS was designed to resolve names, not carry data. Attackers exploit that trust.
An attacker registers a domain and deploys a custom authoritative DNS server. They install a lightweight agent on the compromised host. The agent encodes data — credentials, files, keystrokes — into DNS query strings. The authoritative server receives, decodes, and logs every byte.
No firewall rule blocks it. DNS port 53 is open everywhere. It has to be.
The exfiltration rate is slow. Slow enough to stay invisible in baseline traffic. Fast enough to drain a database over a weekend.
WHY DoH MADE DETECTION HARDER
DNS over HTTPS encrypted the channel. The intent was privacy. The consequence was operational blindness.
Traditional DNS logging captures every query. DoH routes those queries through HTTPS to resolvers like 1.1.1.1 or 8.8.8.8. Your DNS logs show nothing. Your proxy logs show encrypted HTTPS traffic to a trusted CDN.
WHAT IS LOST — query content, destination domains, query frequency, TTL anomalies.
WHAT REMAINS — volume anomalies, timing patterns, connection metadata. Not enough for most SOC playbooks.
Organizations that enabled DoH for privacy handed attackers a detection bypass.
THREE CONTROLS THAT ACTUALLY WORK
- RESPONSE POLICY ZONES Deploy RPZ on your internal resolvers. Block known malicious domains at the DNS layer before any connection is made. Feed it from threat intelligence. Update it daily. A blocked query is an attacker who never reached their C2.
- QUERY ANALYTICS Flag subdomains longer than 52 characters. Flag domains with high entropy in the hostname. Flag hosts generating more than 500 DNS queries per hour. These patterns do not appear in legitimate traffic. They appear in exfiltration.
- PASSIVE DNS LOGGING Log every query, every response, every TTL. Store it. Query it. When an incident happens, DNS logs tell you which hosts contacted which domains and when. Without them, you reconstruct nothing.
DNS carries data your tools were not built to inspect.
The query that exfiltrates your credentials looks identical to the query that resolves google.com. Same protocol. Same port. Same packet size.
The difference is in the subdomain. And nobody is reading subdomains.
Fix your DNS visibility before someone else maps it for you.
Is your SOC collecting and analyzing DNS query logs today?