You can exfiltrate data using regular DNS requests, by hiding the data in the host part of the query. The authoritative name server for the domain can then extract out and re-assemble the data.

https://blogs.akamai.com/2017/09/introduction-to-dns-data-ex...