I don't think DNSSEC ensures the hostnames are secret. From RFC 4033 [0]:
"The DNS security extensions provide origin authentication and integrity protection for DNS data, as well as a means of public key distribution. These extensions do not provide confidentiality."