In stable only via bind or dnscrypt plugin
Yes, but maybe with 20.1 or so, maybe it will go into core directly