This document describes a new transport protocol for DNS. IP fragmentation is avoided, blind spoofing, amplification attacks and other denial of service attacks are prevented. Latency for a typical DNS query is a single round trip, after a setup handshake. No per-client server state is required between transactions. Packets may optionally be encrypted and authenticated. The protocol may have other applications.