DNSCrypt (https://dnscrypt.org/ https://dnscrypt.org/) would be more elegant here (DTLS also okay) and is in-band wrapper for DNS. It's what TLS is for HTTP but

DNSCrypt (https://dnscrypt.org/ https://dnscrypt.org/) would be more elegant here (DTLS also okay) and is in-band wrapper for DNS. It's what TLS is for HTTP but for DNS and keeps things UDP. Worth pointing out, this is not a google project, it just uses Google's DNS over HTTP endpoint. We have one we made at https://www.openresolve.com/ https://www.openresolve.com/