I use Whonix.
I am interested in making clearnet traffic as private from third parties other than the sites I visit, as possible. This not only includes the NSA, but also third-party DNS providers which may log, and even likely be willing to share this information with NSA (such as Google's DNS or OpenDNS), but even just by virtue of hte traffic being unencrypted over the Internet and thus, no matter how well-meaning, still sniffable by anyone on the pipes between you and the DNS provider(s) used by your particular Tor exit node at the time.
Whonix's wiki advice on running DNSCrypt within the VM makes a good point that using DNSCrypt for Tor browsing may not be as advantageous as one may first think.
But if you trust a DNS provider (or a rotating array of them, such as the DNSCrypt community), who not only promises to be logless/less logging and is smaller, security-focused, generally donation-based, AND uses a protocol that at least doesn't broadcast your queried sites with a megaphone on the wires while you communicate with it, wouldn't it still be better?
The question is: do I share what websites my (rotating) Tor IP addresses visit, with MANY highly insecure DNS providers (distributing the inevitable across many providers, even though it's totally sniffable, poisonable, and most likely logged), or with ONE highly secure DNS provider where the traffic is indeed far less likely to be leaked, logged, or sniffed?
It is mind-boggling to think through the ramifications of either choice, privacy and anonymity-wise. NSA would have more information with unencrypted DNS requests to later match to other inevitable clearnet metadata like HTTPS requests between your rotating Tor IPs and the servers you request to start HTTPS sessions with - and of course, all other unencrypted TCP traffic you may visit already. (like apt-get updates)
My idea is to make a simple script (in configuring and restarting dnscrypt-proxy) to rotate through different DNSCrypt providers each day or logon session (or activity that I want to seriously de-correlate to other ones, if uncomfortably close in time to each other), distributing the 'power' and required trust aptly warned on the Whonix wiki, to several providers and not just one.
Could that be combining the best of both worlds and be the very best solution for DNS privacy and security, on Tor?