The DNS protocol was developed in the beginnings of the Internet and still works in an almost unchanged form. Its simplicity is unique and has been proven for years, but the architecture does not provide protection against, for example, tunneling of communications that can be used to leak data from organizations. Our proposed detection of ex-data filtering using the DNS protocol is based on machine learning that is sufficiently resistant to FP (false positives). In a live demonstration, we show the functionality of the technique and the limitations of classical methods.