I run DNS servers behind CurveDNS forwarders at home and it works fine. Of course that's not enough to convince anyone except me that it works. There are some nameservers that offer DNSCurve on the internet. This proves that it works.
The query to 192.5.6.30 is not encrypted because the .com nameservers do not provide a DNSCurve public key prefixed by "uz5" in the subdomain.
The query to 104.248.15.206 is encrypted using DNSCurve. Each packet is encrypted separately. Packets are exchanged via UDP just like regular DNS. DNSCurve predates QUIC.
There is also a free secondary DNS service that will let anyone offer DNSCurve without having to set up CurveDNS forwarders. Assuming they are still in business. I have not tested it. This should put to rest any doubts that DNSCurve actually works. But I know it won't.
The whole point of CurveDNS (and now DoH) is that it works right away, and doesn't depend on the rest of the Internet cooperating with you. It's a bottom-up design, contrasted to DNSSEC's (failed) top-down model. The only problem with DNSCurve is that it's been effectively superseded by DoH. It's the Betamax of secure DNS protocols. Doesn't matter if it's better.
DNSCurve is used to encrypt queries to authoritative DNS servers. DoH is only used to encrypt DNS queries to third party DNS caches. Using third party caches can open the door to cache poisoning. Cache poisoning can be and has been used as a "justification" for deploying DNSSEC.
Right, but (1) most of the value of secure transport for DNSSEC is in the "last mile" between the resolver and the stub resolver on the laptop or whatever, and (2) the same model that secures that hop can secure authoritative lookups for resolvers --- neither protocol is widely deployed for authority queries for recursors, but DoH already has huge deployment numbers for the other use, and seems the more likely bet for how this will play out going forward.
For example,
The query to 192.5.6.30 is not encrypted because the .com nameservers do not provide a DNSCurve public key prefixed by "uz5" in the subdomain.The query to 104.248.15.206 is encrypted using DNSCurve. Each packet is encrypted separately. Packets are exchanged via UDP just like regular DNS. DNSCurve predates QUIC.
There is also a free secondary DNS service that will let anyone offer DNSCurve without having to set up CurveDNS forwarders. Assuming they are still in business. I have not tested it. This should put to rest any doubts that DNSCurve actually works. But I know it won't.
https://www.bunnyns.com