DNS tunneling is used for what purpose in cybercrime?

• A. A method to block DNS queries to prevent C2.
• B. A method to covertly exfiltrate data or hide command-and-control traffic by tunneling through DNS queries.
• C. A method to improve DNS resolution speed.
• D. A legal method to share data publicly.

Answer: (B)

DNS tunneling treats the DNS protocol itself as a covert data channel. Criminals exploit the way DNS requests and responses travel across networks to carry information that isn’t really part of DNS, enabling hidden communication paths for exfiltration or for command-and-control traffic. Because DNS is typically allowed through firewalls and proxies and is widely used, this channel can slip past normal network monitoring, making it attractive for illicit activity. Data is often encoded into the subdomain labels of queries sent to an attacker‑controlled DNS server, which can then decode the information, and responses can carry control instructions or data back, establishing a two-way tunnel.

This approach is not about blocking DNS queries, speeding up DNS lookups, or sharing data legally; it’s about using DNS as a stealthy channel for covert operations in cybercrime.