{"id":120351,"date":"2025-09-09T12:12:52","date_gmt":"2025-09-09T04:12:52","guid":{"rendered":"https:\/\/version-2.com\/?p=120351"},"modified":"2025-09-09T12:14:55","modified_gmt":"2025-09-09T04:14:55","slug":"why-next-generation-firewalls-cant-detect-stealth-dns-attacks","status":"publish","type":"post","link":"https:\/\/version-2.com\/zh\/2025\/09\/why-next-generation-firewalls-cant-detect-stealth-dns-attacks\/","title":{"rendered":"Why Next-Generation Firewalls Can&#8217;t Detect Stealth DNS Attacks"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"120351\" class=\"elementor elementor-120351\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-35fe5dd post-content elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"35fe5dd\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[{&quot;jet_parallax_layout_image&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;_id&quot;:&quot;cef08c3&quot;,&quot;jet_parallax_layout_image_tablet&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_image_mobile&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_speed&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:50,&quot;sizes&quot;:[]},&quot;jet_parallax_layout_type&quot;:&quot;scroll&quot;,&quot;jet_parallax_layout_direction&quot;:&quot;1&quot;,&quot;jet_parallax_layout_fx_direction&quot;:null,&quot;jet_parallax_layout_z_index&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x&quot;:50,&quot;jet_parallax_layout_bg_x_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y&quot;:50,&quot;jet_parallax_layout_bg_y_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size&quot;:&quot;auto&quot;,&quot;jet_parallax_layout_bg_size_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_animation_prop&quot;:&quot;transform&quot;,&quot;jet_parallax_layout_on&quot;:[&quot;desktop&quot;,&quot;tablet&quot;]}]}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-409a2e9a\" data-id=\"409a2e9a\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5a8be8f elementor-widget elementor-widget-text-editor\" data-id=\"5a8be8f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><img fetchpriority=\"high\" decoding=\"async\" class=\"alignnone size-full\" src=\"https:\/\/blog.safedns.com\/content\/images\/size\/w2000\/2025\/09\/Why-NGFWs-Can-t-Detect-Stealth-DNS-Attacks.png\" width=\"1920\" height=\"1080\" \/><\/p><p>This article discusses a significant security gap in modern network defenses: the inability of Next-Generation Firewalls (NGFWs) to detect highly evasive DNS-based attacks. While NGFWs are effective against many threats, they are often blind to malicious activity hidden within DNS traffic, leaving a critical vulnerability that cybercriminals are actively exploiting.<\/p><h2>The Evasion Tactic: How Attackers Use DNS<\/h2><p>Attackers use a technique called DNS tunneling to create a covert communication channel. They encode malicious traffic\u2014such as command-and-control (C2) signals or data exfiltration\u2014within standard DNS queries and responses. Because DNS is an essential part of network communication and is often considered a &#8220;trusted&#8221; protocol, NGFWs and other security tools frequently allow this traffic to pass through uninspected. This provides a perfect, low-detection pathway for a stealth attack.<\/p><h2>Why NGFWs Fall Short<\/h2><p>Next-Generation Firewalls excel at inspecting the content of data packets, but they often struggle with DNS traffic for several reasons: they typically only inspect DNS requests, not the full response; they cannot analyze the deep-level content of a query to detect malicious payloads; and they are not designed to identify the behavioral patterns of DNS tunneling, which involves an unusually high volume of DNS requests to a single domain.<\/p><h2>Closing the Security Gap<\/h2><p>To combat this threat, the article recommends a multi-layered security approach. This includes implementing a dedicated DNS security solution that is designed specifically to analyze DNS queries and responses in real-time. These specialized tools can perform deep packet inspection, apply behavioral analysis to detect DNS tunneling, and block malicious traffic before it reaches the network. By adding a dedicated DNS security layer, organizations can effectively close the gap that NGFWs leave open and create a more resilient defense against advanced cyberattacks.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2004c86 elementor-widget elementor-widget-shortcode\" data-id=\"2004c86\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-shortcode\">\n\t\t<div data-elementor-type=\"page\" data-elementor-id=\"46348\" class=\"elementor elementor-46348\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-6b25dc0d elementor-section-full_width elementor-section-height-default elementor-section-height-default\" data-id=\"6b25dc0d\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[{&quot;_id&quot;:&quot;c4f773e&quot;,&quot;jet_parallax_layout_image&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_image_tablet&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_image_mobile&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_speed&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:50,&quot;sizes&quot;:[]},&quot;jet_parallax_layout_type&quot;:&quot;scroll&quot;,&quot;jet_parallax_layout_direction&quot;:&quot;1&quot;,&quot;jet_parallax_layout_fx_direction&quot;:null,&quot;jet_parallax_layout_z_index&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x&quot;:50,&quot;jet_parallax_layout_bg_x_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y&quot;:50,&quot;jet_parallax_layout_bg_y_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size&quot;:&quot;auto&quot;,&quot;jet_parallax_layout_bg_size_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_animation_prop&quot;:&quot;transform&quot;,&quot;jet_parallax_layout_on&quot;:[&quot;desktop&quot;,&quot;tablet&quot;]}]}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-3cc1b37d\" data-id=\"3cc1b37d\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-52c4a230 elementor-widget elementor-widget-text-editor\" data-id=\"52c4a230\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>About SafeDNS<\/strong><br \/>SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI &amp; ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users&#8217; online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n\t\t<div data-elementor-type=\"page\" data-elementor-id=\"18103\" class=\"elementor elementor-18103\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-748947f elementor-section-full_width elementor-section-height-default elementor-section-height-default\" data-id=\"748947f\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[{&quot;jet_parallax_layout_image&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;_id&quot;:&quot;c4f773e&quot;,&quot;jet_parallax_layout_image_tablet&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_image_mobile&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_speed&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:50,&quot;sizes&quot;:[]},&quot;jet_parallax_layout_type&quot;:&quot;scroll&quot;,&quot;jet_parallax_layout_direction&quot;:&quot;1&quot;,&quot;jet_parallax_layout_fx_direction&quot;:null,&quot;jet_parallax_layout_z_index&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x&quot;:50,&quot;jet_parallax_layout_bg_x_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y&quot;:50,&quot;jet_parallax_layout_bg_y_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size&quot;:&quot;auto&quot;,&quot;jet_parallax_layout_bg_size_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_animation_prop&quot;:&quot;transform&quot;,&quot;jet_parallax_layout_on&quot;:[&quot;desktop&quot;,&quot;tablet&quot;]}]}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-7995c19\" data-id=\"7995c19\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a437045 elementor-widget elementor-widget-image-box\" data-id=\"a437045\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><h3 class=\"elementor-image-box-title\">About Version 2 Digital<\/h3><p class=\"elementor-image-box-description\">Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.\n<br><br>\nThrough an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>This article discusses a significant security gap in mo [&hellip;]<\/p>\n","protected":false},"author":149011790,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[738,1305,61],"tags":[739,1077],"class_list":["post-120351","post","type-post","status-publish","format-standard","hentry","category-safedns","category-1305","category-press-release","tag-safedns","tag-1077"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Why Next-Generation Firewalls Can&#039;t Detect Stealth DNS Attacks - Version 2<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/\" \/>\n<meta property=\"og:locale\" content=\"zh_HK\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why Next-Generation Firewalls Can&#039;t Detect Stealth DNS Attacks - Version 2\" \/>\n<meta property=\"og:description\" content=\"This article discusses a significant security gap in mo [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/\" \/>\n<meta property=\"og:site_name\" content=\"Version 2\" \/>\n<meta property=\"article:published_time\" content=\"2025-09-09T04:12:52+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-09-09T04:14:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.safedns.com\/content\/images\/size\/w2000\/2025\/09\/Why-NGFWs-Can-t-Detect-Stealth-DNS-Attacks.png\" \/>\n<meta name=\"author\" content=\"tracylamv2\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"tracylamv2\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9810\u8a08\u95b1\u8b80\u6642\u9593\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 \u5206\u9418\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2025\\\/09\\\/why-next-generation-firewalls-cant-detect-stealth-dns-attacks\\\/\"},\"author\":{\"name\":\"tracylamv2\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/011bc7c3731c930bcfeecd52fefb6365\"},\"headline\":\"Why Next-Generation Firewalls Can&#8217;t Detect Stealth DNS Attacks\",\"datePublished\":\"2025-09-09T04:12:52+00:00\",\"dateModified\":\"2025-09-09T04:14:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2025\\\/09\\\/why-next-generation-firewalls-cant-detect-stealth-dns-attacks\\\/\"},\"wordCount\":298,\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/blog.safedns.com\\\/content\\\/images\\\/size\\\/w2000\\\/2025\\\/09\\\/Why-NGFWs-Can-t-Detect-Stealth-DNS-Attacks.png\",\"keywords\":[\"safedns\",\"2025\"],\"articleSection\":[\"SafeDNS\",\"2025\",\"Press Release\"],\"inLanguage\":\"zh-HK\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2025\\\/09\\\/why-next-generation-firewalls-cant-detect-stealth-dns-attacks\\\/\",\"url\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/\",\"name\":\"Why Next-Generation Firewalls Can't Detect Stealth DNS Attacks - Version 2\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/blog.safedns.com\\\/content\\\/images\\\/size\\\/w2000\\\/2025\\\/09\\\/Why-NGFWs-Can-t-Detect-Stealth-DNS-Attacks.png\",\"datePublished\":\"2025-09-09T04:12:52+00:00\",\"dateModified\":\"2025-09-09T04:14:55+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/#breadcrumb\"},\"inLanguage\":\"zh-HK\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-HK\",\"@id\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/#primaryimage\",\"url\":\"https:\\\/\\\/blog.safedns.com\\\/content\\\/images\\\/size\\\/w2000\\\/2025\\\/09\\\/Why-NGFWs-Can-t-Detect-Stealth-DNS-Attacks.png\",\"contentUrl\":\"https:\\\/\\\/blog.safedns.com\\\/content\\\/images\\\/size\\\/w2000\\\/2025\\\/09\\\/Why-NGFWs-Can-t-Detect-Stealth-DNS-Attacks.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/blog.safedns.com\\\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9801\",\"item\":\"https:\\\/\\\/version-2.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Why Next-Generation Firewalls Can&#8217;t Detect Stealth DNS Attacks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"name\":\"Version 2\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/version-2.com\\\/zh\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-HK\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\",\"name\":\"Version 2\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-HK\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"width\":1795,\"height\":335,\"caption\":\"Version 2\"},\"image\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/011bc7c3731c930bcfeecd52fefb6365\",\"name\":\"tracylamv2\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-HK\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g\",\"caption\":\"tracylamv2\"},\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/author\\\/tracylamv2\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Why Next-Generation Firewalls Can't Detect Stealth DNS Attacks - Version 2","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/","og_locale":"zh_HK","og_type":"article","og_title":"Why Next-Generation Firewalls Can't Detect Stealth DNS Attacks - Version 2","og_description":"This article discusses a significant security gap in mo [&hellip;]","og_url":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/","og_site_name":"Version 2","article_published_time":"2025-09-09T04:12:52+00:00","article_modified_time":"2025-09-09T04:14:55+00:00","og_image":[{"url":"https:\/\/blog.safedns.com\/content\/images\/size\/w2000\/2025\/09\/Why-NGFWs-Can-t-Detect-Stealth-DNS-Attacks.png","type":"","width":"","height":""}],"author":"tracylamv2","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"tracylamv2","\u9810\u8a08\u95b1\u8b80\u6642\u9593":"3 \u5206\u9418"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/#article","isPartOf":{"@id":"https:\/\/version-2.com\/2025\/09\/why-next-generation-firewalls-cant-detect-stealth-dns-attacks\/"},"author":{"name":"tracylamv2","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/011bc7c3731c930bcfeecd52fefb6365"},"headline":"Why Next-Generation Firewalls Can&#8217;t Detect Stealth DNS Attacks","datePublished":"2025-09-09T04:12:52+00:00","dateModified":"2025-09-09T04:14:55+00:00","mainEntityOfPage":{"@id":"https:\/\/version-2.com\/2025\/09\/why-next-generation-firewalls-cant-detect-stealth-dns-attacks\/"},"wordCount":298,"publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"image":{"@id":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.safedns.com\/content\/images\/size\/w2000\/2025\/09\/Why-NGFWs-Can-t-Detect-Stealth-DNS-Attacks.png","keywords":["safedns","2025"],"articleSection":["SafeDNS","2025","Press Release"],"inLanguage":"zh-HK"},{"@type":"WebPage","@id":"https:\/\/version-2.com\/2025\/09\/why-next-generation-firewalls-cant-detect-stealth-dns-attacks\/","url":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/","name":"Why Next-Generation Firewalls Can't Detect Stealth DNS Attacks - Version 2","isPartOf":{"@id":"https:\/\/version-2.com\/zh\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/#primaryimage"},"image":{"@id":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.safedns.com\/content\/images\/size\/w2000\/2025\/09\/Why-NGFWs-Can-t-Detect-Stealth-DNS-Attacks.png","datePublished":"2025-09-09T04:12:52+00:00","dateModified":"2025-09-09T04:14:55+00:00","breadcrumb":{"@id":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/#breadcrumb"},"inLanguage":"zh-HK","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/"]}]},{"@type":"ImageObject","inLanguage":"zh-HK","@id":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/#primaryimage","url":"https:\/\/blog.safedns.com\/content\/images\/size\/w2000\/2025\/09\/Why-NGFWs-Can-t-Detect-Stealth-DNS-Attacks.png","contentUrl":"https:\/\/blog.safedns.com\/content\/images\/size\/w2000\/2025\/09\/Why-NGFWs-Can-t-Detect-Stealth-DNS-Attacks.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.safedns.com\/why-ngfws-cant-detect-stealth-dns-attacks-and-how-to-close-the-gap\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9801","item":"https:\/\/version-2.com\/"},{"@type":"ListItem","position":2,"name":"Why Next-Generation Firewalls Can&#8217;t Detect Stealth DNS Attacks"}]},{"@type":"WebSite","@id":"https:\/\/version-2.com\/zh\/#website","url":"https:\/\/version-2.com\/zh\/","name":"Version 2","description":"","publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/version-2.com\/zh\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-HK"},{"@type":"Organization","@id":"https:\/\/version-2.com\/zh\/#organization","name":"Version 2","url":"https:\/\/version-2.com\/zh\/","logo":{"@type":"ImageObject","inLanguage":"zh-HK","@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","contentUrl":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","width":1795,"height":335,"caption":"Version 2"},"image":{"@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/011bc7c3731c930bcfeecd52fefb6365","name":"tracylamv2","image":{"@type":"ImageObject","inLanguage":"zh-HK","@id":"https:\/\/secure.gravatar.com\/avatar\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g","caption":"tracylamv2"},"url":"https:\/\/version-2.com\/zh\/author\/tracylamv2\/"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pbQRKm-vj9","post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/posts\/120351","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/users\/149011790"}],"replies":[{"embeddable":true,"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/comments?post=120351"}],"version-history":[{"count":7,"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/posts\/120351\/revisions"}],"predecessor-version":[{"id":120358,"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/posts\/120351\/revisions\/120358"}],"wp:attachment":[{"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/media?parent=120351"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/categories?post=120351"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/tags?post=120351"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}