Anti-Tunneling
Navigation: DNS Security → Anti-Tunneling
DNS tunneling hides data inside DNS labels or record payloads so it can leave the network even when HTTP/TLS is restricted. TOORCE looks for unusual name shape, volume, and record mix — not a single signature — and can block or alert before the tunnel is useful.
What is detected
| Indicator | Why it is suspicious |
|---|---|
| Unusually long or random subdomains | Encoded chunks stuffed into labels |
| High query rate from one client | Continuous exfil or keep-alive |
| Excessive TXT queries | TXT is a common tunnel carrier |
| Encoded payloads in labels | High entropy, base32/base64-like strings |
| Abnormal query / response patterns | Many unique subdomains under one parent, odd qtype mix |
These checks run after rate-limit and threat-intel stages. A domain that is “unknown” on feeds can still be blocked here.
Typical log
{
"src_ip": "192.168.1.88",
"domain": "k7q2m9x1p4w8.example.net",
"qtype": "TXT",
"dnssec": "unsigned",
"category": "unknown",
"reputation": "suspicious",
"action": "block",
"reason": "DNS tunneling pattern"
}
Recommended policy
| Setting | Recommended | Notes |
|---|---|---|
| Anti-Tunneling | On | Enable for LAN and guest networks |
| Long / high-entropy labels | Block | Tune length if you have legitimate long CDN names |
| TXT rate per client | Limit | Allow normal SPF/DMARC; cap burst TXT |
| Unique subdomain burst | Alert then block | Catch fast flux-style encoding |
| Allow-list parents | Required SaaS only | Some CDNs use long labels — list those parents |
What this is not
Anti-Tunneling does not replace DoH/DoT Control. Encrypted DNS to a public resolver never presents the inner name to a port-53 inspector. Block unauthorized DoH/DoT so clients cannot step around these checks.
It also does not replace Anti-DGA. DGA names are generated to find C2; tunneling names are generated to carry data. Both can look random; the engines use different rate and label features.