Worked supporting 2 of the 13 core internet root NS and the major TLDS and it's safe to say you can't escape DNS surveillance.