I read the federal government’s Zero-Trust Memo so you don’t have to

This sounds really beautiful, and I am saving the link for future reference.

I'm curious about the DNS encryption recommendation. My impression was that DNSSEC was kind of frowned upon as doing nothing that provides real security, at least according to the folks I try to pay attention to. Are these due to differing perspectives in conflict, or am I missing something?

DNS over TLS and DNS over HTTP/TLS.

DoT and DoH only encrypt the connection to the recursive resolver, more for privacy than security. You still need DNSSEC to authenticate the results.

DNSSEC is security in the other direction( DNS server -> client ). All DNSSEC does is securely sign all the responses to DNS queries.

so DNSSEC is the answer to, can I trust this IP is valid for the name news.ycombinator.com.

DNS over TLS/HTTPS just says, nobody but the DNS server I use can see I'm wanting news.ycombinator.com's IP. It's mostly useless at the moment, since other gaps exist leaking essentially the same information(SNI, etc), but it should get more useful over time, as people are working on fixing those gaps.

Whatever happened to Dnscrypt?

QUIC and ECH cover the leakage of host information already, so DNS over TLS/HTTPS is plenty useful already IMO. Just needs the hosts to upgrade to support ECH or QUIC. Plus it's never bad to cover your bases, DNS queries are for more than just the browser (ie, for example the SRV record which an application may use for connection data or TXT records for configuration or ACME).

They never even wrote a Draft RFC.

Really? That's disappointing.