"His ISP would still be able to do surveillance, no?"
How's that any different from using any other DNS provider? (Answer: It's
not.) Even if the connection with the DNS servers were encrypted your ISP,
fundamentally, still has to send your traffic around. So they'll still know
who you're communicating with even if they don't know what you're saying.
"Oh, there's an encrypted connection to this DNS server over here. I wonder
what they're looking up."
"Oh, right after that they accessed example.com. So it must have been that."
Avoiding surveillance is a much bigger task. It can still be done by being
self-hosted. But it's a different question. So the other part of the question
might be to send those DNS queries (along with websites that are accessed)
over TOR or something like that.
