DNS C2 means command-and-control traffic that uses the Domain Name System for communication between malware and an attacker. Instead of sending commands over obvious web channels like HTTP or HTTPS, the malware hides data in DNS queries and responses, sometimes by encoding instructions in subdomains, TXT records, or repeated lookups to attacker-controlled domains.
This matters because DNS is usually allowed out of networks and often receives less scrutiny than web traffic. That makes it a useful fallback when proxies, firewalls, or content filters block other channels. Defenders look for signs such as unusually long or random-looking hostnames, high query rates, many failed lookups, odd record types, and DNS patterns that do not match normal user activity. Correlating resolver logs with endpoint telemetry can reveal which host is generating the traffic and whether the DNS behavior supports malware persistence or follow-on payload delivery.