A computer system includes a detector that monitors DNS communications to detect data exfiltration and/or infiltration that is attempted or has occurred in the DNS communications. DNS communications are stored and parsed to distinguish content that is potentially not public being communicated in a prefix and content contained in a publicly available suffix. The content of the prefix is examined to determine an amount of information conveyed in the prefix based at least in part on a length and a number of unique characters of the prefix. The detector aggregates communications for network sources and/or destinations, and/or for different network groups or characteristics to determine sources, destinations, groups, and/or characteristics associated with aggregate amounts of information that satisfy one or more notification conditions or trigger one or more other corrective actions.