DNS Tunneling - Long Query Name with Base64/Base32 Encoded Subdomain (iodine/dnscat2)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•7

Detects DNS query traffic with unusually long subdomains (over 100 characters) that exhibit Base64-like encoding patterns. This is a common behavioral indicator for DNS tunneling tools like iodine or dnscat2, which use DNS queries to encapsulate non-DNS protocol traffic for command and control or data exfiltration.