3 ms·

In a corporate environment you must use only the company DNS internal resolver and they are the only one that should go outside on port 53. This is a basic secu

In a corporate environment you must use only the company DNS internal resolver and they are the only one that should go outside on port 53. This is a basic security measure to detect and block every attempt of DNS tunnelling or exfiltration

tuwtuwtuwtuw 1y ago
Even if you use the internal resolver you could exfiltrate the data.
- pixl97 1y ago
  I mean most of the time said company resolvers have a service that block either suspicious requests, or only allow whitelisted domains.
- lormayna 1y ago
  Yes, but an internal resolver has filtering and must be heavy monitored. If the DNS logs are sent to a SIEM you will be detected quickly