TLS from the stub client to a trusted recursive resolver can withstand the power and capabilities of a passive pervasive monitor, but it does not withstand an attacker that plugs itself into the path between an individual’s stub client and her trusted recursive resolver. To guarantee connectivity with the intended resolver it needs to be authenticated. In the presentation we give an analysis of the authentication mechanisms currently known to be operable for DNS over TLS and evaluate their usability and robustness metrics.