I suppose it could also be implemented with DTLS [0] over UDP [1]. (Checking Wikipedia...) A 2013 paper [2] published some vulnerabilities; mostly implementation flaws, but it raised some questions about the core spec as well.

However you implement it, encrypting DNS probably has it's place, but it doesn't make a whole lot of sense for most applications.

[0] https://en.wikipedia.org/wiki/Datagram_Transport_Layer_Secur...

[1] https://tools.ietf.org/html/rfc6347

[2] http://www.isg.rhul.ac.uk/~kp/dtls.pdf