nprofile1qy2hwumn8ghj7un9d3shjtnddaehgu3wwp6kyqpq99m0a2s2snvg62gds4k3tacqjk84usmhvtfzdfw4ge35jsmu5hqqe5leww (nprofile…leww) TLS can't protect against more things than DNSSEC can:
- spoofing of "real" DNS entries
- spoofing of entries that don't exist
- proof of a NS being authoritative for the domain
the only thing it really does is hide your queries, which, imo, is not the biggest problem? i don't think it constantly warrants the overhead + you have to trust your NS not to tell anyone about your queries (haha lol cloudflare) + your NS might not use it for reverse lookups.