HTTPS is not required to mitigate this. Spoofing the sender IP is only useful to conduct DNS reflection attacks, where a small question is sent, and a much lar

HTTPS is not required to mitigate this. Spoofing the sender IP is only useful to conduct DNS reflection attacks, where a small question is sent, and a much larger response is sent back to the (possibly spoofed source IP). If you require the question to be at least as large as the response, amplification is not a concern any more, so UDP is perfectly fine. This is what the DNSCrypt protocol is doing.