Which DNS record type is commonly observed in DNS tunneling patterns?

• A. A records
• B. TXT records
• C. MX records
• D. CNAME records

Answer: (B)

TXT records are commonly observed in DNS tunneling patterns because they are designed to carry arbitrary text payloads. This makes it easy to encode data or commands into strings and transmit them via DNS queries or responses, enabling covert communication and data exfiltration. TXT records can be composed of multiple strings to carry larger payloads, which is particularly useful for tunneling. In contrast, A records map names to IPv4 addresses, MX records indicate mail servers, and CNAME records provide aliases; none of these are intended to transport arbitrary content, so they’re less suitable for tunneling activities.