The 3 configuration examples given offer different benefits and drawbacks. Our preference would be towards #1, as this minimizes latency while offering security on the transportation layer (and with a DNSSEC validating cache, validation of the origin and answer itself).
From a security standpoint, this should allow the same level of protection that Tor does from an encryption standpoint. Of course the DNS server that you are using knows your IP address and what you are requesting, so either you have to trust the DNS server you are using, or you have to use one of the other 2 options proposed.
The major drawback we see regarding the other 2 options are added latency. DNS is pretty time sensitive, the longer it takes to resolve, the worse things go for you. While adding 3 seconds of latency to an HTTP request isn't good, it's not going to break anything. If you add 3 seconds of latency to a DNS request, it's likely your computer will simply act as if the request failed. So, either SHOULD work, the security offered between them is pretty comparable, but there are many different opinions on this point.
The main reason to go for option 2 or 3 (although not sure there's enough difference between those 2 to really matter) would be wanting to hide your source IP from the DNS server.
SOURCE: OpenDNS Support Team