Winning tactics with DNS tunnelling

The Domain Name System (DNS) protocol is the backbone of the Internet. It facilitates connection to websites and services using understandable names that are easy to remember. DNS converts these names to their corresponding IP addresses in order to establish the communication through the network. The security of the DNS protocol was not originally a major concern for organisations since the protocol was not intended to be used for regular data transmission. 1 However, in recent years, attackers have developed tools that have taken advantage of this situation and utilised DNS for malicious purposes, such as covert tunnelling and data exfiltration.