maybe on a wifi network before authentication when it may allow DNS resolution but not HTTP requests?

Could you shuttle more data through this method to have a browser that works on unauthenticated captive portal wifi networks?

It's called dns tunnelling.

https://github.com/yarrick/iodine