DNS exfiltration: how data leaks over DNS and how to stop it

What DNS exfiltration is

Data exfiltration means moving data out of an organisation without permission. DNS exfiltration does it through DNS lookups, usually as one use of a DNS tunnelling channel.

The trick relies on how DNS resolution works. When a device looks up a name, the question travels through resolvers until it reaches the authoritative server for that domain. The attacker owns a domain and runs its authoritative server. Anything the malware writes into the name being looked up is delivered to that server, even though the lookup looks like any other. The answer does not even need to come back: once the resolver forwards the question, the data has arrived.

Attackers like this route because outbound DNS is permitted almost everywhere, it is rarely inspected as closely as web or email traffic, and many data loss prevention tools only watch files, email and web uploads.

How DNS exfiltration works: a worked example

Here is the process in plain words, using the reserved example domain attacker.example. No real organisation is involved.

1. Malware on a finance workstation collects a spreadsheet of supplier bank details.
2. It compresses the file and converts it into characters that are allowed in domain names, such as letters and digits.
3. It splits the result into chunks. DNS limits each label (the part between dots) to 63 characters and the whole name to 255 bytes, so each lookup carries only a small piece.
4. It looks up names such as 0001.4f2a9c7e1b.attacker.example, 0002.83d1e6aa04.attacker.example and so on, with a sequence number and a session marker in each.
5. The workstation's resolver, if it is an ordinary one, forwards each question to the attacker's authoritative server.
6. The attacker's server logs every query, puts the chunks in order and rebuilds the spreadsheet.

A small document might need hundreds of lookups; a large database many thousands. Patient attackers spread them out over hours or days to stay below the radar, which is why both blocking and detection matter.

Signs of DNS exfiltration

The same features that make exfiltration work also make it visible, if someone is looking:

• Long, random-looking subdomains under one domain, often close to the maximum label length.
• A large number of unique names under a single parent domain, each looked up once.
• Lookups that are mostly unanswered or answered with NXDOMAIN, because the attacker only needs the question to arrive.
• More outbound DNS data than normal from one device, or a steady trickle at odd hours.
• Young or unknown destination domains, often registered shortly before use.
• DNS traffic leaving the network directly from a workstation rather than through your internal DNS servers.

You will only see these signs if DNS logs are collected and analysed. A protective DNS service gives you a log of every lookup and block; the NCSC recommends feeding that data into a SIEM so incidents can be investigated. Repeated blocks from one device deserve a closer look at that device.

Controls that stop DNS exfiltration

The first three do most of the work. Our protective DNS guide explains what to look for in a service, and block DNS over HTTPS covers the encrypted DNS route.

Why a protective resolver matters most

With an ordinary resolver, every lookup for attacker.example is forwarded, so the data leaves however many lookups it takes. With a protective DNS resolver, lookups for a domain that is known to be malicious, or that matches a tunnelling pattern, are answered with a block response and are not forwarded to the attacker's server. The channel closes at the first step.

This is why eligible public sector bodies and schools should use the NCSC's free NCSC PDNS service, and everyone else should choose a commercial service, using the NCSC's guidance on protective DNS for the private sector as a checklist. It also explains the importance of firewall rules: a protective resolver only helps if devices cannot simply send DNS somewhere else. For schools, PDNS for Schools is the starting point.

Where DNS exfiltration fits in an attack

DNS exfiltration is rarely the first thing that happens. It usually comes near the end of an attack that began somewhere else:

1. Initial access: a phishing email, a stolen password or an unpatched system gives the attacker a foothold. A protective resolver can stop many phishing and malware-delivery domains here, before anything else happens.
2. Command and control: the malware contacts its controller, often over DNS or through DGA domains. Blocks at this stage are an early warning that a device is infected.
3. Discovery and collection: the attacker finds and gathers valuable data, such as finance records, customer lists or credentials.
4. Exfiltration: the data leaves, over DNS if other routes are blocked or watched. Ransomware groups often steal data before encrypting systems, so they can threaten to publish it.

The earlier you break this chain, the less there is to clean up. DNS controls help at three of the four stages, which is why they are worth getting right even if you also run strong endpoint and email security. See DNS attacks for the wider picture.

If you suspect DNS exfiltration

1. Involve whoever leads your incident response before acting, so containment is planned and evidence such as DNS and firewall logs is kept.
2. Identify the device from DNS logs, firewall logs and your protective DNS dashboard, and isolate it from the network.
3. Block the destination domain across your protective DNS policy so other infected devices cannot use it.
4. Search your logs for the same domain, and for similar patterns, on other devices.
5. Work out what data was involved and whether it includes personal data. A personal data breach may need to be reported to the ICO under UK GDPR, so take advice early.
6. Fix the gap that let DNS bypass your controls, if there was one, and test it with our DNS security test guide.

How we can help

We can check whether your current DNS set-up would stop or reveal exfiltration, close bypass routes on firewalls and devices, and supply a protective DNS service that fits your estate, from Cisco DNS-layer security to the other DNS security solutions we supply. If you need eyes on alerts, we can also talk to you about managed detection options. Scope is confirmed at quote; contact us to discuss it.