DNS tunneling is a covert channel that hides commands or data inside DNS traffic. Instead of sending malware instructions over obvious web or email connections, an attacker encodes information in domain queries and responses. Because DNS is widely allowed through firewalls and often treated as routine background traffic, this technique can blend into normal network activity.
In cyber security, DNS tunneling matters because it can provide command-and-control, data exfiltration, or staging for malware while avoiding tools that focus only on HTTP or file downloads. Defenders look for signs such as unusually long or random-looking query names, high query volume to a small set of domains, repeated failed lookups, or strange patterns in resolver logs. DNS logging, egress controls, and anomaly detection are common ways to spot and block this kind of abuse.