How would you detect DNS tunneling or command and control over DNS?

Look at query behavior rather than single queries. Signals include unusually long or high entropy subdomain labels, a high ratio of unique subdomains under one parent domain, TXT or NULL record types in volume, steady query intervals rather than human bursts, and one internal host generating disproportionate query volume. Baseline per host and per domain, then enrich with domain age and registration data.

I treat it as a volume and entropy problem. For each parent domain I count distinct subdomains per hour and measure label length and character entropy, because encoding data into a hostname produces long random looking labels that no human typed. I also look at record type mix, since a burst of TXT or NULL queries stands out, and at timing, because implants beacon on an interval and people do not. Then per host: one workstation producing ten times the DNS volume of its peer group is worth a look on its own. The catch is that plenty of legitimate services look exactly like this. Antivirus reputation lookups, content delivery networks and some telemetry agents generate huge numbers of random subdomains, so I baseline and allow list those parents explicitly by their known infrastructure rather than by pattern. To confirm, I check registration age, look for the same parent across multiple hosts, and pull the process making the queries from endpoint telemetry, which usually settles it in a minute.