I suppose it could also be implemented with DTLS [0] over UDP [1]. (Checking Wikipedia...) A 2013 paper [2] published some vulnerabilities; mostly implementatio

I suppose it could also be implemented with DTLS [0] over UDP [1]. (Checking Wikipedia...) A 2013 paper [2] published some vulnerabilities; mostly implementation flaws, but it raised some questions about the core spec as well. However you implement it, encrypting DNS probably has it's place, but it doesn't make a whole lot of sense for most applications. [0] https://en.wikipedia.org/wiki/Datagram_Transport_Layer_Security https://en.wikipedia.org/wiki/Datagram_Transport_Layer_Secur... [1] https://tools.ietf.org/html/rfc6347 https://tools.ietf.org/html/rfc6347 [2] http://www.isg.rhul.ac.uk/~kp/dtls.pdf http://www.isg.rhul.ac.uk/~kp/dtls.pdf