DNS tunnels can be found by looking at a single DNS payload or by looking at traffic statistics like request count and frequency. Using a single request, malicious activity can be found via payload analysis.