I believe the root cause for DNS tunneling is because the internal hosts are allowed to do recursive queries of external domains. For DNS tunneling to work, an internal host should be able to send queries to attacker controlled domain dnstunnel.xyz.com.
I was wondering if we limit DNS queries to known/authoritative DNS servers alone, will it prevent this attack? To make it clear, when we run nslookup for an external domain from within the organization using a third party DNS server, it wouldn't resolve.
C:\Users\bAdb0y>nslookup cisco.com 8.8.8.8
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 8.8.8.8
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to UnKnown timed-out
I tried setting up a DNS tunnel using Iodine with and without the above setting. It failed to establish the tunnel when recursive queries were limited to internal DNS servers. The tunnel worked like charm otherwise. So is this fix effective? Or do I need to disallow recursive query by internal machines completely?