How is DNS tunneling used to exfiltrate data out of a corporate network?

While DNS servers are involved, recursive lookups themselves are not the mechanism for data exfiltration; the data is embedded within the queries/responses.

DNS tunneling works by encoding arbitrary data (the payload) into valid DNS request and response fields, typically within subdomain names or TXT records. This payload is broken into small strings, making the malicious traffic resemble normal DNS lookups and thus often bypasses traditional firewalls and intrusion detection systems.

Redirecting DNS requests to a malicious server is a technique for DNS poisoning or pharming, used for credential theft or redirection, not directly for data exfiltration via DNS tunneling.

Corrupting DNS servers by replacing IP addresses is a description of DNS cache poisoning or pharming, which is a different type of attack than data exfiltration via DNS tunneling.