Theoretical Foundations for Throughput Optimisation in DNS-Tunnelled Virtual Private Networks

DNS tunnelling encapsulates arbitrary TCP traffic inside DNS query-response exchanges, exploiting the structural ubiquity of DNS in modern networks. Despite decades of operational use, the throughput of DNS-tunnel virtual private networks (VPNs) remains poorly understood at a formal level: practitioners configure parameters empirically, and the interplay between payload capacity, resolver selection, retransmission control, packet duplication, and MTU discovery has not been analysed in a unified framework. This paper develops that framework and derives parameter-explicit models that explain the main mechanisms behind the order-of-magnitude throughput improvements observed in practice over classical designs. We prove that reducing per-packet protocol framing overhead from the 59 bytes typical of classical label-encoded designs to a compact 5–7 byte binary header increases upload throughput by approximately 75% at equal query rates. We distinguish two multipath models: under a shared outstanding-query budget, score-proportional dispatch serves as a practical latency-aware heuristic; under independent per-resolver pipelining, the aggregate goodput equals the sum of individual resolver goodputs, yielding linear scaling with pool size in the homogeneous case. For retransmission control, a first-order analysis shows that a NACK-driven selective-repeat scheme can deliver up to 30 times higher goodput than go-back-N retransmission at the loss rates and window sizes typical of DNS tunnels, and we derive engineering bounds on the retransmission timeout under Gaussian RTT jitter. We further show that binary-search MTU probing converges in a logarithmic number of rounds under deterministic probe success and can complete in under 2.3 seconds when parallelised across resolvers, characterise the optimal client-side DNS cache size under a Zipf query arrival model, and prove a liveness guarantee for the adaptive resolver failover subsystem. Together, these results provide a parameter-explicit analytical foundation for the design and performance analysis of DNS-tunnel VPN systems, intended as a theoretical reference for researchers and protocol designers. Disclaimer: This paper is intended solely for academic research and educational purposes. All analyses, models, and results are presented to advance the theoretical understanding of overlay network protocols and are not intended to encourage, facilitate, or support any unlawful activity.