"... but the operator of that resolver..." The operator of the resolver cache is supposed to be the user, not some third party (e.g., OpenDNS/Cisco, etc.). IO

"... but the operator of that resolver..." The operator of the resolver cache is supposed to be the user, not some third party (e.g., OpenDNS/Cisco, etc.). IOW, the cache is meant to be running on the user's computer not some third party computer (e.g., OpenDNS/Cisco, etc.). Using remote (i.e. third party) recursive resolver caches has never been recommended. If anyone is recommending that then they are ignoring the advice of the original author. (There are other reasons to use a local cache, even if not to encrypt outgoing queries, e.g., it reduces/eliminates the risk of cache poisoning.) If you look, you may find there are implementations that did follow the author's advice, e.g., a resolver that only accepts queries from 127.x.x.x. What is missing to have a complete encrypted DNS solution? Authoritative nameservers that implement the system. The recursive part of the system already works. It is controlled locally by users. Authoritative nameservers for www sites however are run by third parties. Cooperation is needed. As for TLS, there may be an alternative encryption solution forthcoming. Similar to encrypted DNS, it will be a small program running on the user's computer that encrypts outgoing packets. An ssl wrapper sort of like stunnel but better. It will not rely on establishing an "encrypted tunnel" like TLS. It will encrypt each packet separately.