DNSCrypt requires responses sent over UDP to never be larger than the question, or else the client must retry with larger padding in the question, or over TCP.

DNSCrypt requires responses sent over UDP to never be larger than the question, or else the client must retry with larger padding in the question, or over TCP. That makes amplification impossible.