[dannypgh]

That's not what DNSSEC is. DNSSEC is about signing the data in DNS, not encrypting it in transit. The same metadata analysis is possible.

[icebraining]

Also, if they can see your DNS, chances are they can see the TLS handshake, so SNI would leak the domain anyway. But a VPN should encrypt both.

[duxet]

Sorry, that's right, i was talking about DNSCrypt of course.