On botnets that use DNS for command and control