Normal DNS over UDP can also contain arbitrary data, which completely hypothetcally could be used to send identifying data about the client. E.g. https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-ca... But that's not really a strike against the protocol, that would be a fault of the implementation.