VPN-over-DNS is a tunneling technique that carries nonstandard traffic through DNS queries and responses. Instead of using a normal VPN port or protocol, the sender encodes data inside DNS messages, which are widely allowed and often less closely inspected. This can make the traffic harder to recognize in passive monitoring, because it may look like ordinary name resolution at a glance.
It matters in cyber security because DNS is present in nearly every network, so it can become a convenient covert channel for command-and-control, data exfiltration, or relay traffic. Defenders look for signs such as unusually high query volume, repeated lookups, rapid domain rotation, and traffic patterns that do not match normal application behavior. DNS telemetry cannot reveal payload content by itself, but it can expose the scale and structure of suspicious tunneling activity.