The root issue (pun not intended) is that DNS is not fully encrypted, not even point-to-point, DNSSEC only provides an integrity check, no encryption; DoT/DoH i

The root issue (pun not intended) is that DNS is not fully encrypted, not even point-to-point, DNSSEC only provides an integrity check, no encryption; DoT/DoH is only used between a resolver and a client as a last-mile solution. No robust security can be derived from the absence of full encryption - there is none, ultimately the traffic is sent in clear over the Internet backbone. You must make your own choice of trust for sending traffic in cleartext - your local network at home/school/hotel, your rented VPS provider, your ISP, or Google/CloudFlare. Given that CloudFlare already has 13%+ market share, as an end-user, if my primary threat is eavesdropping in the middle, not eavesdropping by CloudFlare (or by NSA's subpoena or NSL), it's actually reasonable to trust the tech giants. Using CloudFlare's DoH server helps me to end-to-end encrypt my query of 13% of the domain names! Also, CloudFlare has business plan to adopt private encrypted DNS links to other authoritative servers, and they already have a private channel with Facebook, it's even better! Don't start sending hate replies, I know the bigger picture is that it allows CloudFlare to effectively monopolize DNS is extremely harmful in the long run, and I'm worried. But I simply don't see a perfect alternative solution that allows one to self-host a resolver at home with end-to-end encryption to communicate with authoritative servers. You see, the end results that everyone should work towards is introducing encryption to the missing resolver-authoritative server link. DNSCurve was developed in 2005 as a practical and high-performance protocol for deployment on authoritative servers, and fill the missing link, the protocol is great, DNSCrypt was its direct descendant for last-mile client-resolver encryption. It was ultimately not adopted, partially because of many hate DJB's personal style of taking an aggressive position over technical issue, especially his attack on DNSSEC. But also, the final reason was that the ICANN has stated that, in the case of the DNS Root zone servers, DNSCurve will never ever be implemented. First because its threat model doesn't include the authoritative servers themselves, and it gives them the private key. This is fine for private use, but the DNS root servers are controlled by many political entities, and ICANN doesn't believe trusting them is acceptable. DNSSEC was designed in a way to avoid giving the ultimate key to root servers, but not DNSCurve. Also, DJB hated DNSSEC so much that DNSSEC cannot be used to sign the pubkey for DNSCurve resolver - oops! In the future, we should work toward a solution for resolver-authoritative server encryption. In the article, the author mentioned DNS-over-TLS is a potential solution, if so, we should push to deploy DNS-over-TLS on major authoritative servers, or perhaps one day, on the root servers if a solution has been worked out. Only then, it could allow us to say farewell to CloudFlare's DNS and Google's DoH resolvers. * https://en.wikipedia.org/wiki/DNSCurve https://en.wikipedia.org/wiki/DNSCurve