DNS Tunneling Detection

logging {
    channel query_log {
        file "/var/log/named/query.log" versions 10 size 100m;  
        // Automatic log rotation: keeps 10 previous files, each max 100MB
        // Essential for long-term analysis without filling disk space
        // Allows pattern analysis across weeks of DNS activity
        
        severity info;                                           
        // Log level that captures DNS queries without excessive detail
        // Includes query details but excludes debug information
        // Balance between useful data and log volume
        
        print-time yes;                                         
        // Critical for timeline analysis of tunneling attacks
        // Enables correlation with network security events
        // Helps identify attack duration and timing patterns
        
        print-severity yes;                                     
        // Shows message importance level in log entries
        // Helps filter logs during incident response
        // Distinguishes between routine queries and anomalies
        
        print-category yes;                                     
        // Identifies the type of DNS event (query, update, etc.)
        // Essential for categorizing different tunneling techniques
        // Enables targeted analysis of specific event types
    };
    category queries { query_log; };                           
    // Routes all DNS query events to the specialized log file
    // Separates query analysis from general BIND operational logs
    // Creates focused dataset for tunneling detection algorithms
};

options {
    rate-limit {
        responses-per-second 10;                                
        // Normal DNS clients rarely exceed 10 queries/second
        // Tunneling tools often generate 50-500+ queries/second
        // This limit catches excessive query volumes typical in tunneling
        
        nxdomains-per-second 5;                                
        // CRITICAL: Most effective tunneling detection metric
        // Tunneling often uses non-existent subdomains for data transfer
        // Legitimate clients rarely generate multiple NXDOMAIN responses
        // This setting is specifically designed to catch tunneling patterns
        
        errors-per-second 5;                                   
        // Limits DNS error responses which tunneling tools trigger
        // Helps detect malformed queries used in some tunneling protocols
        // Prevents DNS server resource exhaustion from error floods
        
        window 15;                                             
        // Time window for rate calculations (15 seconds)
        // Shorter windows catch burst patterns common in tunneling
        // Balances detection sensitivity with false positive prevention
        
        slip 2;                                                
        // Forces TCP for every 2nd response when rate limited
        // TCP requirement often breaks tunneling tool assumptions
        // Many tunneling tools expect UDP and fail with TCP enforcement
        
        qps-scale 250;                                         
        // Quality factor allowing short bursts above normal rates
        // Prevents blocking legitimate clients during normal variations
        // Accommodates legitimate applications that may burst queries
        
        log-only no;                                           
        // Actually enforces limits rather than just logging violations
        // Essential for stopping active tunneling attacks
        // Logging-only mode is useful for initial baseline establishment
        
        all-per-second 20;                                     
        // Emergency brake: absolute limit regardless of response type
        // Catches sophisticated tunneling that varies response patterns
        // Final protection against any form of excessive DNS activity
        
        exempt-clients { localhost; 192.168.0.0/16; };        
        // Exempts internal networks from rate limiting
        // Prevents blocking legitimate internal DNS activity
        // Allows monitoring tools and internal systems normal operation
    };

    // DNS response size controls
    max-udp-size 1220;                                        
    // Prevents large DNS responses often used in tunneling
    // Forces large responses to use TCP, breaking many tunneling tools
    // Standard internet MTU considerations prevent fragmentation
    
    // Cache manipulation prevention
    max-cache-ttl 86400;                                       
    // Maximum 24-hour cache duration prevents infinite caching
    // Tunneling attacks sometimes use extreme TTL values
    // Ensures periodic revalidation of suspicious records
    
    min-cache-ttl 300;                                         
    // Minimum 5-minute cache prevents rapid query cycling
    // Tunneling often uses TTL=0 to force constant queries
    // This setting disrupts real-time tunneling communication
    
    // Query flood protection
    clients-per-query 10;                                      
    // Limits simultaneous clients per query (normal behavior)
    // Tunneling botnets often generate identical queries from many IPs
    // Helps detect distributed tunneling infrastructure
    
    max-clients-per-query 100;                                 
    // Hard limit for query distribution patterns
    // Catches large-scale tunneling operations
    // Prevents resource exhaustion from coordinated attacks
};

zone "suspicious-domain.com" {
    type master;
    file "/etc/bind/zones/suspicious-domain.com.zone";
    
    allow-query { localhost; 192.168.0.0/16; };               
    // Restrict queries to internal networks only
    // Prevents external access to potentially compromised domains
    // Allows internal investigation while blocking external abuse
    
    allow-transfer { none; };                                  
    // Completely prevents zone transfers
    // Critical security measure for domains under investigation
    // Prevents attackers from obtaining complete zone data
    // Protects infrastructure information from reconnaissance
};