DNS validation and encrypted forwarding serve different purposes.
Use BuckDNS to manage signed DNS answers and choose supported upstream transports.
Validate signed DNS answers
DNSSEC validates the authenticity of signed DNS data. BuckDNS includes DNSSEC validation and zone-signing capabilities alongside authoritative zone management. Validation depends on the DNS data and configured resolution path.
DNSSEC is not encryption. It does not conceal query names, and it does not establish that the website behind a domain is trustworthy.
Choose encrypted upstream connections
In forwarding mode, configure supported DNS-over-HTTPS or DNS-over-TLS providers. These transports encrypt the connection from BuckDNS to the chosen upstream. UDP and TCP forwarding are also available.
Do not assume that configuring encrypted upstreams encrypts every device-to-server connection. Direct recursion follows the DNS hierarchy over standard DNS. Review each network segment separately.
Keep internal DNS under your control
Authoritative zones serve your own names locally. Conditional forwarding sends selected zones to another resolver, while other requests can follow your normal resolution mode.
Use the existing console and installation documentation to review the configuration for your environment. Keep management restricted to trusted networks.