No. Consider that DNS request/responses are simple, cleartext UDP packets. There's DNSSEC of course but nobody uses it (and also most security experts don't like it).
You could compare it to IPsec, which is what most VPNs use, which is comparable in security and design. They both, together with SSL, suffer from a bad case of design-by-committee, including atrocities like X509.
DNSSEC did get an important thing right. You are in full control of your own keys, and your DNS provider can not impersonate you. Having an external DNS hosting provider was not common back then, but it is now, and I'm glad they got that right.
Indeed, but afaik there are methods to mitigate it (NSEC3) and more refined ones in development (NSEC4, NSEC5).