Ultimately just makes it more complicated to piece together the now multi-part DNS queries to know what people are requesting. Not a problem for the actors behind the threats this is supposed to frustrate.