I did re-read it.

But where's the proof they used DNS? Upload a packet capture and let us be the judge.