DNS exfiltration is a data theft technique that hides stolen information inside Domain Name System traffic, usually by placing encoded data in query names or subdomains. Instead of sending a visible HTTP request, malware or a script triggers lookups such as secret1.attacker-domain.example, where the DNS request itself carries the payload. Because DNS is normal and widely allowed on networks, the traffic can blend in with legitimate name resolution.
This matters in cyber security because DNS exfiltration can bypass simple outbound filtering and make leakage harder to spot in logs. Attackers use it to move small but valuable data fragments, such as credentials or system details, to an external server they control. Defenders look for unusual query volume, long or high-entropy subdomains, repeated failed lookups, and DNS requests to rare domains. Mitigations include egress controls, trusted resolvers, DNS logging, anomaly detection, and limiting which hosts can make direct external DNS queries.