DNS tunnelling has changed. And in most cases, it is not even officially 'tunnelling'. The latest techniques for covertly transferring data over DNS are more creative and even harder to detect. Over the last year, we've been analysing DNS tunnelling tools, command-and-control traffic, multi-staged payloads, and exfiltration modules to profile how DNS is being abused and to develop reliable detection techniques. In this session we'll describe each pattern using traffic observed in the wild and provide novel ways to detect them. Finally, we'll release exfilr, an open-source tool for covertly transferring data over DNS which implements all patterns described and can serve as a detection testbed or a penetration testing tool.