{"id":122220,"date":"2025-09-09T12:12:48","date_gmt":"2025-09-09T04:12:48","guid":{"rendered":"https:\/\/v2catalog.com\/?p=122220"},"modified":"2026-01-28T17:44:52","modified_gmt":"2026-01-28T09:44:52","slug":"why-next-generation-firewalls-cant-detect-stealth-dns-attacks","status":"publish","type":"post","link":"https:\/\/v2catalog.com\/zh\/why-next-generation-firewalls-cant-detect-stealth-dns-attacks\/","title":{"rendered":"Why Next-Generation Firewalls Can’t Detect Stealth DNS Attacks"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>

This article discusses a significant security gap in modern network defenses: the inability of Next-Generation Firewalls (NGFWs) to detect highly evasive DNS-based attacks. While NGFWs are effective against many threats, they are often blind to malicious activity hidden within DNS traffic, leaving a critical vulnerability that cybercriminals are actively exploiting.<\/p>

The Evasion Tactic: How Attackers Use DNS<\/h2>

Attackers use a technique called DNS tunneling to create a covert communication channel. They encode malicious traffic\u2014such as command-and-control (C2) signals or data exfiltration\u2014within standard DNS queries and responses. Because DNS is an essential part of network communication and is often considered a “trusted” protocol, NGFWs and other security tools frequently allow this traffic to pass through uninspected. This provides a perfect, low-detection pathway for a stealth attack.<\/p>

Why NGFWs Fall Short<\/h2>

Next-Generation Firewalls excel at inspecting the content of data packets, but they often struggle with DNS traffic for several reasons: they typically only inspect DNS requests, not the full response; they cannot analyze the deep-level content of a query to detect malicious payloads; and they are not designed to identify the behavioral patterns of DNS tunneling, which involves an unusually high volume of DNS requests to a single domain.<\/p>

Closing the Security Gap<\/h2>

To combat this threat, the article recommends a multi-layered security approach. This includes implementing a dedicated DNS security solution that is designed specifically to analyze DNS queries and responses in real-time. These specialized tools can perform deep packet inspection, apply behavioral analysis to detect DNS tunneling, and block malicious traffic before it reaches the network. By adding a dedicated DNS security layer, organizations can effectively close the gap that NGFWs leave open and create a more resilient defense against advanced cyberattacks.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t
\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t

About SafeDNS<\/h3>

\nSafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users' online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t

About Version 2<\/h3>

\nVersion 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.\n
\nThrough an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

This article discusses a significant security gap in modern network defenses: the inability of Next-Generation Firewalls (NGFWs) to detect highly evasive DNS-based attacks. While NGFWs are effective against many threats, they are often blind to malicious activity hidden within DNS traffic, leaving a critical vulnerability that cybercriminals are actively exploiting. The Evasion Tactic: How Attackers […]<\/p>\n","protected":false},"author":148019288,"featured_media":93478,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_wpcom_ai_launchpad_first_post":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1757,1376,1516],"tags":[1756,1517],"class_list":["post-122220","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-1757","category-press-release","category-safedns","tag-1756","tag-safedns"],"acf":[],"yoast_head":"\nWhy Next-Generation Firewalls Can't Detect Stealth DNS Attacks - V2Catalog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/\" \/>\n<meta property=\"og:locale\" content=\"zh_HK\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why Next-Generation Firewalls Can't Detect Stealth DNS Attacks - V2Catalog\" \/>\n<meta property=\"og:description\" content=\"This article discusses a significant security gap in modern network defenses: the inability of Next-Generation Firewalls (NGFWs) to detect highly evasive DNS-based attacks. While NGFWs are effective against many threats, they are often blind to malicious activity hidden within DNS traffic, leaving a critical vulnerability that cybercriminals are actively exploiting. The Evasion Tactic: How Attackers […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/\" \/>\n<meta property=\"og:site_name\" content=\"V2Catalog\" \/>\n<meta property=\"article:published_time\" content=\"2025-09-09T04:12:48+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-01-28T09:44:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/v2catalog.com\/wp-content\/uploads\/2024\/10\/left-safeDNS.png\" \/>\n\t<meta property=\"og:image:width\" content=\"656\" \/>\n\t<meta property=\"og:image:height\" content=\"214\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"tracylamv2\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"tracylamv2\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9810\u8a08\u95b1\u8b80\u6642\u9593\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 \u5206\u9418\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/v2catalog.com\\\/why-next-generation-firewalls-cant-detect-stealth-dns-attacks\\\/\"},\"author\":{\"name\":\"tracylamv2\",\"@id\":\"https:\\\/\\\/v2catalog.com\\\/#\\\/schema\\\/person\\\/949d980888460b8203c48a6e6c719cca\"},\"headline\":\"Why Next-Generation Firewalls Can’t Detect Stealth DNS Attacks\",\"datePublished\":\"2025-09-09T04:12:48+00:00\",\"dateModified\":\"2026-01-28T09:44:52+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/v2catalog.com\\\/why-next-generation-firewalls-cant-detect-stealth-dns-attacks\\\/\"},\"wordCount\":298,\"image\":{\"@id\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/v2catalog.com\\\/wp-content\\\/uploads\\\/2024\\\/10\\\/left-safeDNS.png\",\"keywords\":[\"2025\",\"safedns\"],\"articleSection\":[\"2025\",\"Press Release\",\"SafeDNS\"],\"inLanguage\":\"zh-HK\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/v2catalog.com\\\/why-next-generation-firewalls-cant-detect-stealth-dns-attacks\\\/\",\"url\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/\",\"name\":\"Why Next-Generation Firewalls Can't Detect Stealth DNS Attacks - V2Catalog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/v2catalog.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/v2catalog.com\\\/wp-content\\\/uploads\\\/2024\\\/10\\\/left-safeDNS.png\",\"datePublished\":\"2025-09-09T04:12:48+00:00\",\"dateModified\":\"2026-01-28T09:44:52+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/v2catalog.com\\\/#\\\/schema\\\/person\\\/949d980888460b8203c48a6e6c719cca\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/#breadcrumb\"},\"inLanguage\":\"zh-HK\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-HK\",\"@id\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/#primaryimage\",\"url\":\"https:\\\/\\\/v2catalog.com\\\/wp-content\\\/uploads\\\/2024\\\/10\\\/left-safeDNS.png\",\"contentUrl\":\"https:\\\/\\\/v2catalog.com\\\/wp-content\\\/uploads\\\/2024\\\/10\\\/left-safeDNS.png\",\"width\":656,\"height\":214},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/v2catalog.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Why Next-Generation Firewalls Can’t Detect Stealth DNS Attacks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/v2catalog.com\\\/#website\",\"url\":\"https:\\\/\\\/v2catalog.com\\\/\",\"name\":\"V2Catalog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/v2catalog.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-HK\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/v2catalog.com\\\/#\\\/schema\\\/person\\\/949d980888460b8203c48a6e6c719cca\",\"name\":\"tracylamv2\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-HK\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g\",\"caption\":\"tracylamv2\"},\"url\":\"https:\\\/\\\/v2catalog.com\\\/zh\\\/author\\\/tracylamv2\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Why Next-Generation Firewalls Can't Detect Stealth DNS Attacks - V2Catalog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/","og_locale":"zh_HK","og_type":"article","og_title":"Why Next-Generation Firewalls Can't Detect Stealth DNS Attacks - V2Catalog","og_description":"This article discusses a significant security gap in modern network defenses: the inability of Next-Generation Firewalls (NGFWs) to detect highly evasive DNS-based attacks. While NGFWs are effective against many threats, they are often blind to malicious activity hidden within DNS traffic, leaving a critical vulnerability that cybercriminals are actively exploiting. The Evasion Tactic: How Attackers […]","og_url":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/","og_site_name":"V2Catalog","article_published_time":"2025-09-09T04:12:48+00:00","article_modified_time":"2026-01-28T09:44:52+00:00","og_image":[{"width":656,"height":214,"url":"https:\/\/v2catalog.com\/wp-content\/uploads\/2024\/10\/left-safeDNS.png","type":"image\/png"}],"author":"tracylamv2","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"tracylamv2","\u9810\u8a08\u95b1\u8b80\u6642\u9593":"4 \u5206\u9418"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/#article","isPartOf":{"@id":"https:\/\/v2catalog.com\/why-next-generation-firewalls-cant-detect-stealth-dns-attacks\/"},"author":{"name":"tracylamv2","@id":"https:\/\/v2catalog.com\/#\/schema\/person\/949d980888460b8203c48a6e6c719cca"},"headline":"Why Next-Generation Firewalls Can’t Detect Stealth DNS Attacks","datePublished":"2025-09-09T04:12:48+00:00","dateModified":"2026-01-28T09:44:52+00:00","mainEntityOfPage":{"@id":"https:\/\/v2catalog.com\/why-next-generation-firewalls-cant-detect-stealth-dns-attacks\/"},"wordCount":298,"image":{"@id":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/#primaryimage"},"thumbnailUrl":"https:\/\/v2catalog.com\/wp-content\/uploads\/2024\/10\/left-safeDNS.png","keywords":["2025","safedns"],"articleSection":["2025","Press Release","SafeDNS"],"inLanguage":"zh-HK"},{"@type":"WebPage","@id":"https:\/\/v2catalog.com\/why-next-generation-firewalls-cant-detect-stealth-dns-attacks\/","url":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/","name":"Why Next-Generation Firewalls Can't Detect Stealth DNS Attacks - V2Catalog","isPartOf":{"@id":"https:\/\/v2catalog.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/#primaryimage"},"image":{"@id":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/#primaryimage"},"thumbnailUrl":"https:\/\/v2catalog.com\/wp-content\/uploads\/2024\/10\/left-safeDNS.png","datePublished":"2025-09-09T04:12:48+00:00","dateModified":"2026-01-28T09:44:52+00:00","author":{"@id":"https:\/\/v2catalog.com\/#\/schema\/person\/949d980888460b8203c48a6e6c719cca"},"breadcrumb":{"@id":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/#breadcrumb"},"inLanguage":"zh-HK","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/"]}]},{"@type":"ImageObject","inLanguage":"zh-HK","@id":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/#primaryimage","url":"https:\/\/v2catalog.com\/wp-content\/uploads\/2024\/10\/left-safeDNS.png","contentUrl":"https:\/\/v2catalog.com\/wp-content\/uploads\/2024\/10\/left-safeDNS.png","width":656,"height":214},{"@type":"BreadcrumbList","@id":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/v2catalog.com\/"},{"@type":"ListItem","position":2,"name":"Why Next-Generation Firewalls Can’t Detect Stealth DNS Attacks"}]},{"@type":"WebSite","@id":"https:\/\/v2catalog.com\/#website","url":"https:\/\/v2catalog.com\/","name":"V2Catalog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/v2catalog.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-HK"},{"@type":"Person","@id":"https:\/\/v2catalog.com\/#\/schema\/person\/949d980888460b8203c48a6e6c719cca","name":"tracylamv2","image":{"@type":"ImageObject","inLanguage":"zh-HK","@id":"https:\/\/secure.gravatar.com\/avatar\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g","caption":"tracylamv2"},"url":"https:\/\/v2catalog.com\/zh\/author\/tracylamv2\/"}]}},"jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/v2catalog.com\/wp-content\/uploads\/2024\/10\/left-safeDNS.png","_links":{"self":[{"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/posts\/122220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/users\/148019288"}],"replies":[{"embeddable":true,"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/comments?post=122220"}],"version-history":[{"count":7,"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/posts\/122220\/revisions"}],"predecessor-version":[{"id":122227,"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/posts\/122220\/revisions\/122227"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/media\/93478"}],"wp:attachment":[{"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/media?parent=122220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/categories?post=122220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/v2catalog.com\/zh\/wp-json\/wp\/v2\/tags?post=122220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}