Some time ago, I did some tests related to DNS tunneling identification. What was wrong with that scenario was that the test was not based on a real-life setup. DNS tunneling happened only inside the infrastructure (LAN environment), without any connection to the Internet or external DNS servers. Such a scenario can influence how vendors identify DNS tunneling. I decided to make the tests as close as possible to a real-life DNS tunneling technique. For this purpose, I registered the domain sys-up.pl and set up an authoritative DNS server at ns1.sys-up.pl. For this purpose, I wrote my own custom DNS tunneling tool. The client was written in PowerShell, and the command-and-control server was written in Python.I do not want to publish the code this time, because with some tweaks this tool could be used in real scenarios.
How it works
- Client is polling for a CNAME record of the domain pool.sessionid.sys-up.pl.
- The C2 server does nothing until a command is created.
Then the command is encoded to Base32, and the C2 server dynamically publishes a CNAME record as command-in-base32.sys-up.pl. - If there is any output from the executed command, the client queries for an A record of the domain output-in-base32.sys-up.pl.
DNS records have character limits, so if the output is too large for a single query, the client chunks the output and sends the appropriate number of queries. - The C2 server puts all chunks together, decodes them from Base32, and retrieves data such as command output or files.
- To deliver files to the client (infiltration), TXT records are used.
When the server sends a command to download files, it dynamically publishes subdomains with TXT records containing Base64-encoded data.
The client queries the TXT records, downloads the data, reassembles the chunks, and decodes them from Base64.
Here you can see how it works.
Identification part
The client is protected by a Palo Alto Networks firewall running PAN-OS 12.1.4 with a dedicated license for DNS protection (Advanced DNS Security). The domain sys-up.pl was registered on 06.01.2026.I played with DNS tunneling for about one hour on the evening of 07.01.2026. As expected, the domain sys-up.pl was classified as new (best practice is to block new domains). The next day, when I played again in my lab, the domain classification changed to Tunneling. I do not know exactly when the category was changed, but it is worth mentioning again that DNS tunneling activity lasted only about one hour.
Conclusion
I have to admit that my previous test was not very good and did not reflect real-world scenarios. With a proper scenario, detection looks completely different and protection is provided. This test was done only with Palo Alto Networks; previously I also tested Fortinet and Cisco Umbrella. I will try to find some time and repeat exactly the same scenario with other vendors as well.