Query entropy is a measure of how random a DNS name looks. A human-readable domain such as mail.example.com has relatively low entropy, while a string of mixed letters, numbers, and symbols usually has higher entropy. In practice, high entropy often means the label was generated or encoded by software rather than typed by a person.
This matters in cyber security because DNS tunneling, malware beacons, and domain-generation algorithms often produce unusual query patterns. Attackers may encode data into subdomains or rotate through randomized names to move commands and results past basic filters. Defenders use query entropy as a detection signal in DNS logs, usually alongside other clues such as long labels, repeated bursts, uncommon domains, and frequent failed lookups. Entropy is not proof of malicious activity, but it is a useful way to find traffic that deserves closer inspection.