Attackers are storing malware in DNS TXT records and reassembling it on infected devices through ordinary DNS queries. The same records carry command-and-control (C2) traffic and exfiltrated data. Long treated as a theoretical threat, the technique now appears in real campaigns, and adam:ONE® 4.14.2-266 and later can block TXT records by policy.
How the technique works
A TXT record holds arbitrary text attached to a domain name. Its legitimate uses include email authentication (SPF, DKIM and DMARC) and domain verification. An attacker encodes a payload as hexadecimal or base64, splits it into chunks, and publishes each chunk in a TXT record on a different subdomain. Malware on the device queries those subdomains and rebuilds the payload. Because DNS traffic is rarely inspected for content, the payload passes antivirus, email filters and firewalls that never look at DNS answers. Encrypted DNS (DNS-over-HTTPS and DNS-over-TLS) also hides the query content from traditional monitoring tools.
Two published reports document the technique. DomainTools’ “Malware in DNS” describes an actor who used TXT records to store, and potentially deliver, ScreenMate malware and stagers for the Covenant C2 framework as far back as 2021-2022. DomainTools found chunks of the Joke Screenmate malware in TXT records on whitetreecollective[.]com. Infoblox’s “DNS: A Small but Effective C2 System” explains how attackers who control an authoritative name server use DNS queries to exfiltrate data or issue commands, and reports similar tactics for deploying Cobalt Strike beacons and other remote access tools.
“DNS TXT records are like the Swiss Army knife of domain data. Versatile for everything from spam prevention to software licensing, but this versatility makes them a prime target for abuse,” said David Redekop, Founder and CEO of ADAMnetworks. “By assembling malware on the fly via DNS, attackers evade endpoint protections, making this a blind spot for many defenses.”
What our passive DNS data shows
Through our DNS threat intelligence sharing program, we analyzed a year of TXT queries covering more than 14,000 unique FQDNs that each received more than 10 TXT queries. Most traffic is legitimate: email security, domain ownership verification, S/MIME and TLSA, ACME certificate issuance and CDN geolocation. We also found private IP addresses leaking in FQDNs, queries for non-public suffixes such as “id.server”, BitTorrent signaling, and DNS tunneling through Android apps such as SlowDNS, which could be used for data exfiltration. The figures count queries, not successful lookups; domain risk policies blocked many of them. The full analysis, including which endpoints actually need TXT answers, is in our article DNS TXT Records: The Swiss Army Knife of Domain Data.
Blocking TXT records in adam:ONE
Our approach is “block all, allow some”. adam:ONE Zero Trust Connectivity (ZTc) version 4.14.2-266 and later lets administrators block TXT records by policy and exempt trusted domains through forwarding rules, so internal networks and critical applications keep working without exposing them to attacks such as DNS rebinding. We advise against blanket TXT blocks on public resolvers, which could disrupt global internet functionality. Targeted policies on-premises are the practical safeguard.
