The website requests an image or whatever from 27748626267848298474.example.com, where the number is unique for the visitor. To load the content the browser has to resolve the DNS for it, and the randomness ensures it won't be cached anywhere as it's just for you. So it queries its DNS server which queries your DNS provider which queries the website's DNS server. From there the website's DNS server can see where the request came from and the website can tell you where it came from and who it's associated with if known.

Yes it absolutely can be used for fingerprinting. Everything can be used for fingerprinting, and we refuse to fix it because "but who thinks of the ad companies???".

Without looking at it it’s probably making a unique request to a resource on a NextDNS subdomain and watching where the request comes from. Like pulling an image from (unique _string).check.nextdns.com. This requires nothing special on the client, it’s making a standard request, and as part of that it needs to do a DNS lookup.

If the source of the and your IP are similar then it’s likely the same network, otherwise it can correlate the source with known resolvers.

https://www.dnsleaktest.com/

Put a record in DNS whose content differs from other servers'. When they look it up regularly, they get one answer. When they look it up with you, they get a special answer. Then the servers behind those records return the relevant answer.