Page Comparison

...

http://signatures.juniper.net/documentation/applications/Remote-Access%3ATunneling%3AOZYMAN-DNS-TUNNEL.html

Use IDP, AppID is relatively ineffective for this purpose.

These are your primary signatures;
  DNS:TUNNEL:DNS2TCP   
  DNS:TUNNEL:I2P-DNS-QUERY  
  DNS:TUNNEL:IODINE    
  DNS:TUNNEL:NULL-RECORD
  DNS:TUNNEL:OZYMANDNS  
  DNS:TUNNEL:SHORT-TTL