Original text by Adam Rice The article “DOOM Over DNS” demonstrates an unusual proof-of-concept showing how the classic game DOOM can be stored and executed entirely using DNS infrastructure. The author exploits the fact that DNS TXT records allow arbitrary text data and are rarely validated or monitored in depth. By Base64-encoding binary files, splitting them into chunks, and storing them across thousands of TXT records in a DNS zone, the author turns DNS into a distributed file storage system. To make the idea practical, a modified C# port of DOOM (managed-doom) was used so the compiled .NET assemblies could be loaded directly from memory instead of the filesystem. The project compresses the DOOM WAD and engine binaries, uploads the encoded chunks into roughly 2,000 DNS TXT records, and then uses a PowerShell loader (~250 lines) to query these records, reassemble the data in memory, and execute the game without writing anything to disk. The result is a fully working DOOM instance launched entirely from DNS queries. Beyond being a humorous technical experiment, the article highlights how DNS infrastructure can be abused as a global, distributed storage and delivery channel, which has implications for malware staging, covert payload distribution, and forensic evasion. If you’ve ever poked at one of my CTF challenges, you’ve probably noticed a pattern – I love hiding payloads in TXT DNS records. I stash the malicious code in a TXT record, have the implant query for it at runtime, and now suddenly the payload is being delivered by the same infrastructure that resolves grandmas-cookie-recipes.com. It’s trivially easy to set up and surprisingly annoying to catch forensically, because who’s flagging the historic contents of TXT records? I’ve always suspected the technique could go further than staging shellcode. TXT records are just arbitrary text fields with no validation. If you can store a payload, you can store a file. If you can store a file, you can store a progra...
First seen: 2026-03-27 18:30
Last seen: 2026-03-27 22:32