In most organizations, DNS is the one protocol that always gets out. Web traffic goes through a proxy and email through a gateway, but when a computer asks for any name, that query reaches the internet one way or another. Attackers know this, so they use DNS as a transport.
How a tunnel is built
The attacker runs the authoritative server for a domain they control. Malware inside the network splits the data it wants to steal into small pieces, encodes each one as a label under that domain and asks for it, for example aGVsbG8gd29ybGQ.t.attacker.example. Because the organization's resolver does not know the name, it carries the query all the way to the attacker's server. Commands come back inside the answer. Data goes out and instructions come in.
A single query looks harmless. The problem is hundreds or thousands of unique names under the same domain every minute.
Signs that give a tunnel away
- Many unique subdomains under one registered domain, never asked again
- Long, random-looking labels that do not match any dictionary words
- Record types such as TXT or NULL that ordinary users rarely ask for
- Most answers coming back as NXDOMAIN
- A steady stream of queries from a single client lasting for hours
Relatives: DGA and random-subdomain attacks
Some malware regenerates the name of its command server every day with an algorithm (DGA). A name that lands on a blocklist is useless the next day. These names look random too, but unlike a tunnel the registered domain itself is random.
In a random-subdomain attack the goal is not to steal data but to flood the target domain's authoritative servers. The attacker asks for thousands of non-existent subdomains; none of them are cached, so every query goes straight to the target.
How NameDefence catches them
Defender evaluates every query before the answer goes back. Tunnel detection looks at the number of unique names under one domain, label length and character distribution. DGA detection uses a word list and a language model to tell whether a label is made of meaningful words or generated by a machine, so long but real names are not blocked by mistake.
Random-subdomain protection counts all sources together per registered domain. When the threshold and NXDOMAIN ratio are exceeded, the domain is protected for a while and queries are no longer carried to the target.
What happens after detection
Every blocked query is logged with the user and computer name. An alarm rule fires; if you want, a ticket opens in ServiceNow or Jira and the device is isolated through CrowdStrike or Microsoft Defender for Endpoint. The security team can see in the threat hunting view who else queried the same domain with a single search.
In short
You cannot turn DNS off, but you can see what travels through it. When tunnels, DGAs and random-subdomain attacks are caught at the DNS layer, data is stopped before it leaves the network.