Thanks for all your comments. Below I put quick replies to some of them:

1/ I hope to update the project to use QUIC soon, so it will use encrypted UDP to fetch DNS data from Google Public DNS. It is somehow similar to the DNS over DTLS idea, developed under IETF dprive WG.

2/ dingo does not need to resolve dns.google.com. Providing the server IP address is enough (IPv4 or IPv6, make sure it is close to your location). dingo verifies the server certificate to make sure we talk to Google. It can even "spoof" the TLS SNI string to avoid HTTPS firewalls, too (by default it asks for www.google.com, which is pretty benign).

3/ Last but not least, it's just my first non-trivial Golang project - thanks for all your suggestions! :)