DNS telemetry can expose malware command-and-control (C2), tunneling, and data theft, but no single odd query proves an attack. The most reliable workflow is to collect DNS records with client and process identity, hunt for behavior that differs from a host’s baseline, and corroborate the signal with endpoint and network evidence before containing a system.
Why DNS telemetry can reveal malware
DNS is a routine part of network activity and is often permitted through firewalls, which makes it useful to attackers as well as legitimate software. Malware can use DNS to contact attacker-controlled infrastructure, receive commands, beacon to a controller, or carry data in query names and record data. MITRE ATT&CK describes DNS as a potential command-and-control protocol in technique T1071.004; it notes that data can be concealed in DNS packet fields and that infrequent beacons can be difficult to distinguish from normal traffic.
As an Amazon Associate I earn from qualifying purchases.
DNS telemetry shows observable behavior, not intent by itself. A long subdomain, a TXT query, a burst of lookups, or a failed response may be worth investigating, but each can also occur for legitimate reasons. Treat detections as leads to validate with the client’s role, process lineage, destination, and activity over time.
Recommended Free Tools
What DNS logs and telemetry should you collect?
Start with recursive resolver query and response logs centralized in your logging platform. Preserve enough context to search across hosts and reconstruct an event. Where possible, collect:
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
- Timestamp, with consistent time synchronization across resolvers and endpoints.
- Client or asset identifier, such as an address plus a reliable mapping to a host or device.
- Queried fully qualified domain name, query type, response code, and response data when available.
- Resolver identity and the path by which the request reached it.
- Endpoint DNS events and process lineage, including the executable or script that initiated the lookup.
- Network flow or connection records that help associate a DNS answer with later traffic.
On Windows, MITRE ATT&CK identifies Sysmon Event ID 22 as a source for DNS query logging and Event ID 3 for network connections that can be related to process activity. Coverage and event detail depend on endpoint configuration. MITRE’s Network Traffic Content data component also identifies PCAP and session data, and tools such as Zeek, Wireshark, tcpdump, Suricata, and Snort as collection or analysis options.
Choose collection sources for the question you need to answer
| Source | What it helps establish | Important limitation |
|---|---|---|
| Recursive resolver logs | Which names were queried, when, by which identifiable client, and how the resolver responded; useful for broad history and retrospective hunts. | Client attribution and available response detail depend on resolver configuration and network architecture. |
| Endpoint DNS and process telemetry | Which process or user initiated a lookup and how it fits into a process tree. | Coverage and lineage quality vary by platform; unmanaged or uninstrumented devices can leave gaps. |
| Network flow or session records | Connections and traffic patterns that can be correlated with DNS activity. | May not contain DNS payload, and correlation can be difficult when clients share resolvers or addresses. |
| Packet or payload capture | Protocol-level inspection and, where visible, deeper investigation of DNS content. | Full capture has storage, capacity, privacy, retention, and staffing costs. Encrypted DNS content is not visible to passive capture unless it is decrypted or collected at an endpoint or resolver. |
| Protective DNS and threat intelligence | Known malicious domain matching, policy enforcement, and potentially blocking or sinkholing. | Coverage depends on intelligence quality, resolver adoption, policy controls, and available logs; new or low-reputation activity may not be listed. |
The Australian Cyber Security Centre’s July 2025 Gateway Technology Guides – Gateway Security Guidance Package recommends using logs, telemetry, and protocol payload as appropriate. It describes identifying tunneling through payload inspection or statistical analysis, including anomaly detection based on uniqueness and volume and matching against threat-intelligence indicators. Resolver logs are generally more scalable for retrospective query searches; payload capture can reveal protocol details that logs alone may not preserve.
How do you hunt for suspicious DNS behavior?
Build baselines by client, asset role, and domain rather than relying on one universal threshold. A workstation, resolver, mail server, and software-update service have different normal DNS patterns. Compare both short windows, which can expose bursts, and longer windows, which are needed to find occasional beacons.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Look for combinations of signals
- Unusual volume or frequency: a spike or sustained rate of queries to one domain or a small set of domains, especially when the activity is new for that host.
- Long, unique, or encoded-looking labels: repeated, changing subdomains beneath one registered domain can be consistent with data being carried in query names. Length or apparent randomness alone is not proof.
- Unusual record types or response patterns: query types or answers that do not fit the client’s established role or software activity. TXT records can carry data, but a TXT query by itself is not malicious.
- Repeated failures: unusual NXDOMAIN or other failed lookups, particularly when paired with pseudo-random-looking domains, repeated retries, or suspicious process activity.
- Low-and-slow repetition: periodic lookups that are infrequent enough to disappear in a short window. Extend the time range and compare intervals rather than treating low volume as reassurance.
- Unexpected process origin: DNS initiated by a shell, script interpreter, office application, or other process that has no clear business reason to resolve external names.
- New or known-bad infrastructure: a domain with no prior history in your environment or a match to a threat-intelligence indicator. Record the indicator’s source and age so analysts can judge its relevance.
MITRE ATT&CK’s DNS detection guidance includes high-frequency or anomalous queries from non-browser and non-system processes, long or encoded subdomains, query volume, and known malicious infrastructure. Its dynamic-resolution analytics also emphasize correlating unusual or pseudo-random domains and repeated failures with process lineage. These are hunting directions, not universal alert thresholds.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Make the alert explain what changed
An actionable alert should show the client, time range, queried domain and labels, query types, response codes, observed rate or change from baseline, initiating process if available, and any matching threat-intelligence source. Include the reason the behavior was selected—such as repeated unique labels under a newly observed domain—so the analyst can test the hypothesis rather than inherit a bare “suspicious DNS” verdict.
How do you investigate an alert before containment?
- Validate the event: confirm the timestamp, client identity, resolver path, queried name, query type, and response. Check for duplicate logging, address reuse, or attribution gaps.
- Pivot to the endpoint: inspect the process tree, user, parent process, script or command activity, and nearby security events. Determine whether the process normally performs DNS lookups on that asset.
- Establish destination context: inspect the domain’s history in your environment, associated answers and destination IPs, and any later connections. Check for legitimate software, security products, CDNs, and business services that may explain the traffic.
- Compare across time and hosts: see whether the pattern is new, periodic, isolated to one host, or normal for a particular server or application role. A pattern common to a specific service may be anomalous on a workstation.
- Enrich carefully: compare against threat-intelligence indicators and note each indicator’s source and age. Use matches as evidence to weigh, not as a substitute for local context.
- Decide and document: escalate or contain when independent evidence supports malicious activity. Preserve the DNS events and related endpoint and network records so the decision can be reviewed and the detection tuned.
The Australian Cyber Security Centre recommends matching DNS telemetry against cyber threat intelligence and using accumulated logs for historical investigation. A domain match is more useful when joined to the affected host’s process and connection history.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How can you detect DNS tunneling and exfiltration?
For a tunneling or exfiltration hunt, focus on how query names and their timing behave together. Repeated, high-uniqueness labels below one domain, especially when they appear to encode data and are generated by an unexpected process, warrant investigation. Check whether the sequence is high-volume or periodic, how long it persists, which responses it receives, and whether the same client makes related network connections.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not restrict the hunt to high-volume transfers. Infrequent beacons and low-throughput data exchange are harder to distinguish from routine DNS and may require longer lookback windows and correlation with process and network activity. Legitimate services can also exchange data through DNS, so verify the service owner and purpose before treating an apparent data channel as malicious.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
A 2017 study, Detection of Malicious and Low Throughput Data Exfiltration Over the DNS Protocol, reported at least 99% recall and a false-positive rate below 0.01% for its detector evaluation on medium-scale recursive resolver logs containing more than 75,000 legitimate uses and almost 2,000 attacks. Those are results for that study’s evaluation, not a general performance guarantee for other environments or products. The authors also reported that low-throughput exfiltration was more difficult and used a rule-based filter for legitimate DNS data-exchange services.
What changes when DNS is encrypted?
DNS over HTTPS (DoH), DNS over TLS (DoT), and DNS over QUIC (DoQ) protect DNS traffic between a client and resolver. With encrypted DNS, passive network inspection may no longer show the query names or payload. DoH uses HTTPS on port 443, so port-only rules cannot reliably distinguish it from other HTTPS traffic; DoT and DoQ have their own ports and policy considerations.
Encrypted DNS shifts where useful visibility is available: to the approved resolver’s logs, endpoint configuration and telemetry, and managed proxy or security layers. The Australian Cyber Security Centre’s July 2025 gateway guidance warns that encrypted DNS can create visibility and policy challenges while providing confidentiality and integrity protections.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Define which resolvers are approved and how their query logs reach the central platform.
- Manage endpoint DNS settings and firewall, proxy, and protective-DNS policy so clients do not silently bypass organizational controls.
- Investigate unexpected resolver use through endpoint and network evidence; do not assume a passive packet sensor can inspect encrypted query content.
How should you tune and measure DNS detections?
Start with broad behavioral detections, then tune against analyst-confirmed cases in your own environment. Record both true detections and legitimate activity that generated alerts; measure local precision and coverage rather than importing a lab result as an expected benchmark.
- Prefer narrow exceptions tied to a verified domain, host or asset group, process, and documented business purpose.
- Verify ownership and purpose before allowing a DNS data-exchange service, then review exceptions as software, infrastructure, and business needs change.
- Keep exceptions visible in the alert context so analysts know which rule or exception applied.
- Test detection windows long enough to include infrequent activity, and assess whether baseline changes are masking newly introduced behavior.
- Track whether alerts provide the identity and context needed for investigation, not only how many events they generate.
For broader deployment guidance, NIST SP 800-81 Rev. 3, Secure Domain Name System (DNS) Deployment Guide, was published on 19 March 2026. NIST posted a planning note about potential errata on 10 July 2026, so consult the current publication status when using it as an implementation reference.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
