Block by Record Query Type (TXT)

TXT records are a common channel for command and control (C2) and data exfiltration that even large enterprises struggle with. Most devices do not need TXT record types to function correctly.

It would be a large posture improvement for anyone utilizing NextDNS if all TXT record type queries could be blocked by an optional filter.

Further, an additional enhancement for TXT record length to trigger a notification would have high-fidelity and worth investigation by NextDNS account admins.

Here’s a discourse thread by the threat intel non-profit IFIN discussing the challenges among secure professionals.

https://discourse.ifin.network/t/protecting-against-dns-command-smuggling-data-retrieval-and-more/677/4