Some sort of secure channel DNS seems likely to trickle down. Especially since an MTA is already well past getaddrinfo. And STS already requires https (which I do find kind of weird). So all the heavy lifting code of some form of secure DNS is here.