I don't get it. The blog kinda nails it's own point in the first paragraph. > It allows you to authenticate that the packet you received from the DNS server yo

I don't get it. The blog kinda nails it's own point in the first paragraph. > It allows you to authenticate that the packet you received from the DNS server you connected to is the one that it sent, and also encrypts it over that single hop. I guess the bit that's missing is, 'who is disagreeing with this?'