Inline detect and block relayed dns tunneling traffic

A method, comprising:

• obtaining web traffic across an enterprise network;
• obtaining a hostname comprised in the web traffic;
• querying a security service for a Domain Name System (DNS) tunneling attack verdict based at least in part on the hostname;
• determining whether the web traffic is malicious traffic based at least in part on the DNS tunneling attack verdict;
• and
• handling the web traffic based at least in part on a determination of whether the web traffic is malicious traffic based at least in part on the DNS tunneling attack verdict.

A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

• obtaining web traffic across an enterprise network;
• obtaining a hostname comprised in the web traffic;
• querying a security service for a Domain Name System (DNS) tunneling attack verdict based at least in part on the hostname;
• determining whether the web traffic is malicious traffic based at least in part on the DNS tunneling attack verdict;
• and
• handling the web traffic based at least in part on a determination of whether the web traffic is malicious traffic based at least in part on the DNS tunneling attack verdict.