DNS tunnelling and covert channels¶

Attack pattern¶

A network that blocks DNS stops working, which is the whole of the advantage. Tunnelling puts the payload in the question, where a name runs to 255 bytes across labels of 63, base32-encoded so it survives the case folding that resolvers apply without asking. The answer comes back in a TXT or NULL record, where the size limit is generous and nobody reads the content. Bandwidth is measured in kilobytes rather than megabytes, and the traffic is not hidden so much as unremarkable, which is a different property and often the more durable one. What gives it away is rarely the payload. It is the shape: a single zone answering thousands of unique subdomains, entropy in the labels where readable words would be, and an NXDOMAIN rate that no ordinary application produces.

1. Data Exfiltration Techniques [OR]

    1.1 DNS Tunnelling [AND]

        1.1.1 Protocol Selection [OR]
            1.1.1.1 Traditional DNS (TXT, NULL records)
            1.1.1.2 DoH/DoT/DoQ encrypted tunnelling
            1.1.1.3 ICMP-based DNS manipulation

        1.1.2 Evasion Methods [OR]
            1.1.2.1 Query rate limiting bypass
            1.1.2.2 Legitimate traffic blending
            1.1.2.3 Multiple resolver rotation

        1.1.3 Data Encoding [OR]
            1.1.3.1 Base32/64 encoding variations
            1.1.3.2 Compression with error correction
            1.1.3.3 Fragmentation and reassembly

    1.2 Covert Channels [OR]

        1.2.1 Timing-Based Exfiltration [OR]
            1.2.1.1 Query response timing modulation
            1.2.1.2 DNS refresh interval exploitation
            1.2.1.3 TTL value manipulation

        1.2.2 Storage Channels [OR]
            1.2.2.1 DNS cache poisoning with data
            1.2.2.2 NSEC3 gap exploitation
            1.2.2.3 DNSSEC signature embedding

        1.2.3 Behavioural Patterns [OR]
            1.2.3.1 Query sequence encoding
            1.2.3.2 Resolver selection patterns
            1.2.3.3 Domain name generation algorithms

    1.3 Exfiltration Infrastructure [OR]

        1.3.1 Command and Control [OR]
            1.3.1.1 Dynamic domain generation
            1.3.1.2 DNS-based payload delivery
            1.3.1.3 Dead drop resolvers

        1.3.2 Data Processing [OR]
            1.3.2.1 Distributed exfiltration aggregation
            1.3.2.2 On-the-fly decoding services
            1.3.2.3 Cloud function data processing

        1.3.3 Persistence Mechanisms [OR]
            1.3.3.1 Multiple exfiltration pathways
            1.3.3.2 Fallback communication channels
            1.3.3.3 Anti-forensic techniques

A protocol nobody is allowed to block¶

DNS leaves almost every network, because a network that stops it stops working. Egress filtering rarely gets a vote.
The question carries the data. A name holds 255 bytes across labels of 63, base32-encoded to survive case folding, which prices the channel in kilobytes.
Answers ride in TXT or NULL records, where the size allowance is generous and the content is not inspected.
The tell is the shape rather than the payload: unique subdomain counts against one zone, label entropy, NXDOMAIN rate, and query volume that no application accounts for.
Encrypted transports remove the on-path view, which moves a DoH tunnel out of the wire’s jurisdiction and into the endpoint’s and the resolver’s logs.
Timing and TTL channels trade nearly all the bandwidth for nearly all the stealth, which makes them a signalling mechanism rather than a way to move a database.