Which indicator besides unusually long domain names helps spot DNS tunneling patterns?

• A. Many NXDOMAIN responses
• B. Frequent TXT responses
• C. High rate of A records
• D. Frequent TLS handshakes

Answer: (B)

DNS tunneling hides data inside DNS messages, so patterns that carry payloads through the DNS channel are key to spotting it. Besides unusually long domain names, seeing a high frequency of TXT records in DNS queries and responses is a strong indicator. TXT records are designed to hold arbitrary text, so attackers often encode and exfiltrate data within them, making TXT responses a telltale sign of tunneling activity. Other choices don’t map as directly to the tunneling pattern: NXDOMAIN bursts can happen for many reasons, a lot of A records are normal for standard name resolution, and TLS handshakes pertain to a different protocol layer entirely, not DNS.