What is DNS tunneling?

• A. Encrypting DNS responses.
• B. Resolving domain names to IPs only.
• C. Blocking DNS traffic.
• D. Using DNS queries to send hidden data.

Answer: (D)

DNS tunneling is a covert communication technique that uses the DNS protocol itself to carry hidden data. By encoding information into DNS queries (often within subdomain labels) and sending them to an attacker-controlled DNS server, data can be exfiltrated or commands issued without drawing typical network inspection attention. This exploits the fact that DNS traffic is frequently allowed through firewalls, making it a suitable channel for covert data transfer.

Encrypting DNS responses describes securing DNS data (like DNS over TLS/HTTPS or DNSSEC), not tunneling data. Resolving domain names to IPs only is just the basic function of DNS, not a method for covert communication. Blocking DNS traffic is a defensive action, not a technique used to transmit data. The concept of using DNS queries to send hidden data best fits DNS tunneling.