High-volume DNS TXT record queries indicative of tunneling/C2 beaconing

Duo Tech@duotech

•updated Aug 4, 2026•4•0•8

Detects a high-volume DNS TXT-record query flood (200+ queries in 5 minutes) to a single destination, excluding common legitimate high-volume TXT consumers (SPF/DKIM/DMARC validators), indicative of DNS tunneling.