I think if you make the key a subdomain and you run the dns server for that domain it should be possible to make it work

ie:

secret.attacker-domain.com will end up asking the dns for attacker-domain.com about secret.attacker-domain.com, and that dns server can log the secret and return an ip