How tunneling relates to DNS exfiltration
Ordinary DNS supports service discovery and name resolution. Tunneling uses DNS fields to carry other information. DNS-based exfiltration describes information leaving an environment through that channel; command-and-control describes instructions or coordination. A tunnel may serve either purpose, and its record type alone does not establish intent.
MITRE ATT&CK documents adversarial use of DNS for application-layer communication. For defenders, the practical question is whether a client’s DNS activity fits its legitimate role and whether repeated signals point to a channel that merits investigation.
Signals Raven can evaluate
Raven DNS Guard includes independently enabled anomaly detectors. They assess bounded activity rather than assuming that a single unusual lookup proves tunneling. Indicators and RPZ sources can also identify known destinations, while behavioral checks help surface suspicious patterns that do not depend on a listed domain.
- Entropy and DGA-like checks for generated-looking names.
- Long domain or label checks for unusually large names.
- TXT-rate checks for abnormal request activity over a detection window.
- Unique-subdomain checks for repeated changes beneath a parent domain.
- NXDOMAIN-rate checks for unusual name-not-found activity that may add investigation context.
Thresholds, recovery, and false positives
Configured thresholds, consecutive risk windows, and healthy recovery windows govern anomaly enforcement. Rate-based checks use the relevant observation window; long-name thresholds are absolute rather than time-scaled. Confirm the enabled detectors and policy action when assessing what an alert or block means.
Legitimate services can use TXT records, encoded-looking names, or many unique subdomains. Establish a baseline for the clients being protected and investigate recurring patterns before broadening enforcement. Raven supports domain and client exemptions with detector scope and optional expiry; keep exceptions narrow enough to preserve useful coverage.
Connect the DNS signal to an investigation
Use client, domain, reason, action, and policy context to review a suspected incident. Raven aggregates rate-based events into bounded incidents and retains limited evidence samples. This supports investigation but is not a complete packet capture or inspection of every exfiltrated payload.
Correlate DNS evidence with endpoint activity and network observations. DNS filtering can constrain traffic using Raven; clients that bypass the managed resolver require separate network and endpoint controls. Neither DNSSEC validation nor encrypted DNS transport by itself determines whether a legitimate-looking query is carrying unwanted data.