I've looked at the code more closely, and it does not implement cryptographic verification of ordinary DNS lookups (res_query). This means we could get away with leaving out the crypto, if we really needed to. zw