DNS Tunneling#

bgscan tests whether DNS resolvers can carry a tunnel connection. Three protocols are supported, each with its own configuration format stored as a separate TOML file under assets/dns-tunneling/.

Navigate to Main Menu → DNS Tunneling to manage tunnel configurations.

Protocols#

DNSTT and VayDNS run the tunnel in-process using the vaydns library. Slipstream shells out to an external binary and communicates through a local SOCKS5 port.

All three protocols support optional SOCKS5 or SSH proxy routing with password or key authentication.

How It Works#

A DNS tunnel scan proceeds in two stages when check_dns_resolver is enabled:

1. Resolver pre-scan — each target IP is tested as a DNS resolver. Only resolvers that pass basic DNS queries (and the DPI check when enabled) proceed to the tunnel stage.
2. Tunnel probe — each surviving resolver is tested for its ability to carry a tunnel connection. The probe establishes a full tunnel stack (DNS packet channel → KCP transport → Noise encryption → smux multiplexing) and validates the connection.

When adaptive_resolver is enabled, the resolver pre-scan automatically uses the same transport, port, and domain as the tunnel configuration, ensuring the resolver test matches the tunnel’s actual path.

Reported latency measures the tunnel after it is up, excluding startup cost.

Managing Configurations#

The DNS Tunneling table at Main Menu → DNS Tunneling lists all saved tunnel configurations:

Configuration Storage#

Tunnel configs are stored as TOML files:

assets/dns-tunneling/
├── dnstt/
│   └── <config-name>.toml
├── vaydns/
│   └── <config-name>.toml
└── slipstream/
    └── <config-name>.toml

DNSTT Configuration#

DNSTT uses the vaydns library with DNSTT-compatible framing (DNS-over-TXT with legacy framing). The tunnel stack is: DNS packet channel → KCP → Noise encryption → smux multiplexing.

Connection Settings#

Proxy and Authentication#

Proxy rules:

• SSH proxy requires authentication (password or key).
• SOCKS proxy does not allow key authentication.

TLS Fingerprints#

The Fingerprint field selects a uTLS ClientHello profile to mimic during the TLS handshake. Labels are matched case-insensitively.

Example Config#

Domain = "example.com"
PubKey = "0000000000000000000000000000000000000000000000000000000000000000"
ResolverType = "udp"
ResolverPort = 53
Fingerprint = "Chrome"
RPS = 0
ProxyType = "socks"
ProxyPort = 1080
AuthMethod = "none"

VayDNS Configuration#

VayDNS is the native vaydns protocol. It uses the same tunnel stack as DNSTT (DNS → KCP → Noise → smux) but with native framing and additional tuning parameters for QNAME structure, MTU, and record type.

Connection Settings#

Advanced Settings#

DNS Record Types#

Supported RecordType values: A, AAAA, CNAME, NS, MX, TXT, SRV, NULL, CAA.

The record type determines which DNS record type is used for tunnel queries. TXT is the default and most widely supported.

Proxy and Authentication#

Same fields as DNSTT (see Proxy and Authentication above).

Example Config#

Domain = "example.com"
PubKey = "0000000000000000000000000000000000000000000000000000000000000000"
ResolverType = "udp"
ResolverPort = 53
Fingerprint = "Chrome"
RecordType = "TXT"
ClientIDSize = 2
MaxQnameLen = 101
MaxNumLabels = 0
MTU = 0
RPS = 0
ProxyType = "socks"
ProxyPort = 1080
AuthMethod = "none"

Slipstream Configuration#

Slipstream runs as an external process (slipstream-client binary), not an in-process Go tunnel. It communicates through a local SOCKS5 port allocated per probe.

Connection Settings#

Proxy and Authentication#

Same fields as DNSTT (see Proxy and Authentication above).

Binary Location#

bgscan searches for the slipstream-client binary in the following locations:

1. <bgscan-root>/assets/slipstream-client/slipstream-client
2. <bgscan-root>/assets/slipstream/slipstream-client/slipstream-client
3. <bgscan-root>/slipstream-client/slipstream-client
4. <bgscan-root>/slipstream-client
5. System PATH

Example Config#

Domain = "example.com"
ResolverPort = 53
CertPath = ""
ProxyType = "socks"
ProxyPort = 1080
AuthMethod = "none"

Platform Defaults#

Worker counts and timeouts are automatically adjusted based on the detected platform and resource tier:

Related Topics#

• DNS Settings — Resolver and tunnel orchestration settings
• Scan Types — How DNS tunneling fits in the scan pipeline
• Result Files — Tunnel result file format