EnclaveDNS

A validating DNSSEC resolver running in an attested enclave: every answer is checked from the root keys down, and the operator of the machine cannot see or change what you ask. It also resolves .eth names from ENS and .onion addresses itself, never asking the public DNS about either. No query is ever logged.