Stupid question: What do I need to do to use DNS-over-TLS?
I am running a recursive resolver in my home network (BIND9), so if that is a requirement, it is not a problem.
EDIT: I misunderstood; I though this would encrypt communication between resolvers and authoritative nameservers, too. :(
Your recursive resolver is still going off over the internet and querying (root) DNS entries in clear text. My understanding is that this would wrap it in TLS to stop your ISP (or coffee shop) either spying on what sites you're resolving (read visiting) or even man-in-the-middling and re-writing your DNS responses.
EDIT: I misunderstood; I though this would encrypt communication between resolvers and authoritative nameservers, too. :(