DNS tunneling is a form of cyberattack where hackers are able to route DNS requests to compromised DNS servers.
The method used to perform DNS tunneling attacks is to first compromise a user’s device and then download a malicious payload on the device. Then hackers aim to establish a C2 connection with the target device. To achieve that aim, hackers want the user to send DNS queries to the compromised DNS server they have set up. The actual DNS tunneling hides within the data for DNS queries.
For the DNS tunnel, the compromised device would send a DNS query to the compromised server via different DNS resolvers. Then, the compromised C2 server would send a response with malicious DNS data.