I'm going to be generous here and assume they meant authenticated encryption rather than just encryption between the user and the first DNS server they hit.

Which, given how DNSCurve was designed, is a non sequitur :)