Yes, it's putting the data into the name you're querying (the "qname" in DNS parlance). Say you have a message M of some length to exfiltrate, so first encode

Yes, it's putting the data into the name you're querying (the "qname" in DNS parlance). Say you have a message M of some length to exfiltrate, so first encode it as base64 or whatever, then break up the encoded message into chunks of 63 bytes (ASCII characters, since you encoded in base64), then send DNS lookups for ${n}.${chunk}.${some_label_identifying_exfiltration_instance}.${attacker_domain}. It doesn't matter what the replies are (NXDOMAIN is fine), or maybe you want a receipt confirmation encoded as an A or AAAA RR, whatever. You don't even need a tool because you can just script this from scratch every time you need this. The server could just log all the queries -- all you have to do is reassemble them. One could send junk queries to these domains to try to muck with such attacks, so maybe the attacker could add a label with a MAC to every query name. Really, this is unstoppable except via a) throttling, b) detecting this sort of thing, c) investigating detected attempts. (Or you can disallow direct DNS access to the Internet, forcing everything to go through proxies.)