Dnssec still has your data in the clear, it just signs the data. (And is not supported by most domains)
Re:Metadata is the real data
by cryptonector on Friday June 02, 2017 @11:11AM
(#14470451)
DNSSEC only gives you two things, and only when all zones on the path to the domains you're looking at are signed: authentication of the response data, and authenticated denial of existence (NXDOMAIN).
DNSSEC does NOT encrypt requests nor responses.
And once you set up the router, the cost of configuration is zero.