While DNSCrypt is again an IETF draft and not an RFC yet, its spec is pretty standard - PKI cryptography over plain DNS delivered on port 443 by default 🙂