Robots Atlas>ROBOTS ATLAS
Safety

DNS Tunneling

1998ActivePublished: 28 September 2026Updated: 28 September 2026Published
Key innovation
Turning DNS — a protocol firewalls almost always allow and rarely inspect — into a covert, bidirectional transport channel for arbitrary data.
Category
Safety
Abstraction level
Pattern
Operation level
Agent runtimeDeploymentSystem
Use cases
Data exfiltrationCommand-and-control (C2)Firewall and egress-filtering bypassCaptive portal bypassCovert malware communication channelExfiltration/C2 vector for AI agents with network access

How it works

1) The attacker controls a domain and its authoritative name server. 2) The client (implant or compromised agent) encodes a payload into the query’s subdomain labels, e.g. <base32-data>.tunnel.example.com. 3) The local/recursive resolver, lacking a cached answer, forwards the query up the chain to the attacker’s server. 4) The attacker’s server decodes the data from the query name and replies with a record (TXT/NULL/CNAME/A) encoding return data or a command. 5) The client decodes the response and repeats the cycle, yielding a bidirectional channel. The throughput-vs-detectability trade-off is tuned via record type, label length (63-char label / 253-char name limits) and query rate. Variants include heartbeat/beacon signalling (confirming infection) and control signalling via response codes (NXDOMAIN vs NOERROR).

Problem solved

From an attacker’s perspective it solves the problem of bypassing egress filtering and firewalls: when direct HTTP/HTTPS or TCP connections are blocked, DNS almost always stays open, letting the operator sustain communication and exfiltrate data without raising alarms. From a defender’s perspective it defines a specific threat vector that must be monitored and constrained.

Components

Tunneling client (encoder)Encodes the payload into subdomain labels and issues DNS queries.

Victim-side component (implant, script, compromised agent) that chunks data, encodes it (Base32/Base64/hex) and embeds it in query names directed at the attacker-controlled domain.

INArbitrary data to exfiltrate or a command request.
OUTDNS query with encoded data in the subdomain labels.

Official

Attacker authoritative name server (decoder)Receives queries for the controlled domain, decodes data and responds.

DNS server set as authoritative for the attacker’s domain. Reconstructs data from query names and encodes responses in TXT/NULL/CNAME/A/AAAA records, closing the C2 loop.

INQuery forwarded through the resolver chain.
OUTRecord (TXT/NULL/CNAME/A) carrying return data or a command.
Encoding scheme and record selectionMaps arbitrary bytes onto DNS-legal characters and high-capacity record types.

DNS disallows arbitrary bytes in names, so data is encoded (Base32/Base64/hex). Return transport favours high-capacity records (TXT, NULL) or A/AAAA/CNAME for stealth.

Official

Recursive resolver chainUnwitting relay that forwards queries to the attacker’s server.

The victim’s recursive resolvers (corporate or public) which, in normal operation, forward uncached queries up the DNS hierarchy, enabling the tunnel without a direct client-attacker connection.

Implementation

Implementation pitfalls
Low throughput and UDP unreliabilityMedium

DNS relies mostly on UDP without retransmission; bulk transfers are slow, unreliable and prone to packet loss.

Fix:Chunking with sequence numbers, application-level retransmission, payload compression.
High detectability at volumeHigh

Large volumes of long, high-entropy queries to a single domain are easy to flag via name-length, entropy and volume analysis.

Fix:Rate limiting, domain rotation, legitimate-traffic mimicry; on defence — monitoring and quotas.

Evolution

1998
First public articulation of tunneling over DNS
Inflection point

The idea of using DNS as a data channel appears publicly on the Bugtraq mailing list (Oskar Pearson).

2000
NSTX — one of the first IP-over-DNS tools

NSTX appears, enabling IP tunneling over DNS and demonstrating the technique’s practicality.

2004
OzymanDNS (Dan Kaminsky) and DNScat-P
Inflection point

Dan Kaminsky’s OzymanDNS enables SSH and file transfer over DNS; DNScat-P (Tadeusz Pietraszek) expands the toolset.

2006
iodine — a robust IPv4-over-DNS tunnel

iodine provides a stable IPv4-over-DNS tunnel with TUN/TAP interfaces and multiple record types.

2008
tcp-over-dns with compression

tcp-over-dns introduces compression (LZMA) to raise effective tunnel throughput.

2017
APT adoption (DNSMessenger, OilRig BONDUPDATER)

DNS tunneling reaches real campaigns: the DNSMessenger RAT and OilRig’s BONDUPDATER use A and TXT records as a C2 channel.

2024
Recognized as an exfiltration vector for AI agents

As autonomous agents with network tools proliferate, DNS tunneling is analysed as an exfiltration and C2 channel that bypasses egress filtering.

Hyperparameters (configurable axes)

DNS record typeHigh

Record type used for the return channel; affects capacity and detectability.

TXTHigh capacity, common in C2.
NULLVery high capacity, less typical.
CNAMEStealthy, carries names.
A / AAAASignalling via IP addresses.
Encoding schemeHigh

How bytes are mapped onto DNS-legal characters.

Base32
Base64
hex
Query rateHigh

Throughput/stealth trade-off: higher rates raise bandwidth but ease detection.

Label / name lengthMedium

DNS limits: 63 chars per label, 253 chars per full name — bounding per-query chunk size.

Hardware requirements

Primary

A purely network/software technique — it neither requires nor benefits from specialized hardware.