DNS logs show one internal host querying thousands of long, random-looking subdomains of a single unfamiliar domain, mostly TXT record lookups, at a steady rate. What is the most likely explanation, and which control addresses it?
Select an answer to reveal the explanation.
Short Explanation
Real people don't look up thousands of gibberish subdomains of one domain. Those random-looking labels are encoded data, and the attacker's name server on the other end is reading them like a letter. You stop it at the DNS layer, because that's the channel being abused.
Full Explanation
DNS tunneling encodes data in DNS queries and responses. The client places encoded chunks in subdomain labels of a domain whose authoritative server the attacker controls, and receives data back in responses, often TXT records. Indicators include high volumes of unique, long, high-entropy subdomains under one domain, a heavy share of TXT or other unusual record types, and steady query rates from a single host. Because the recursive resolver forwards these queries outward, the data leaves even when direct internet access is blocked. DNS-layer security, such as the DNS protection in Cisco Secure Access, recognizes tunneling patterns and known tunneling domains and blocks resolution, while forcing hosts to use approved resolvers prevents bypass. DNS amplification is a reflection denial-of-service attack that uses spoofed source addresses to flood a victim, not one internal host steadily querying random subdomains. A misconfigured DHCP option would cause resolution failures or use of the wrong server, not structured random labels under one domain. CDNs use stable hostnames rather than thousands of unique random labels, and allowlisting would hide the exfiltration. Exam caveat: payload is encoded, not necessarily encrypted. Operational check: measure unique subdomain counts per parent domain and confirm the host's queries are now blocked.