DNSCurve and DNSCrypt use authenticated encryption.
DNSCrypt is not stuck to "a single ciphersuite designed by djb". The ciphersuite is negotiated (using DNS queries + signed responses in DNSCrypt v2, and TLS in DNSCrypt v3).
Over TCP, it's not limited to "per-packet encryption" either.
DNSCrypt is not stuck to "a single ciphersuite designed by djb". The ciphersuite is negotiated (using DNS queries + signed responses in DNSCrypt v2, and TLS in DNSCrypt v3).
Over TCP, it's not limited to "per-packet encryption" either.