How do DNS tunneling tools like DNSCat2 avoid DNS caching?

Standard DNS operates on UDP port 53; using a different port would break normal DNS resolution and would not interact with caching mechanisms at all.

Sending packets at regular intervals does not affect cache lookup behavior, since caching is keyed on domain name uniqueness, not query timing.

DNS resolvers cache responses keyed to the exact fully-qualified domain name queried. By encoding data payloads into randomly generated subdomains (e.g., a1b2c3.attacker.com, d4e5f6.attacker.com), DNSCat2 ensures no two queries are identical, so no cached response exists and every packet must be resolved all the way to the attacker's authoritative name server. This preserves the bidirectional covert channel and is a defining characteristic of DNS tunneling evasion.

Standard DNS queries are not encrypted (absent DoH/DoT), and encrypting query content would not prevent caching - caching is based on the domain name in the query, not the payload.