How to Detect DNS Tunneling in the Network?

This report explains how attackers use DNS tunneling (including TXT and uncommon query types) for C2 and data exfiltration—citing BazarCall/BazaLoader, Anchor, and APT activity—and describes network detection techniques such as identifying long/uncommon queries, consistent algorithmic query structures, unknown/unpopular DNS destinations, and distinguishing legitimate security product traffic from bot-generated DNS traffic.