Use DNS over HTTPS (DoH) and only connect to relays that have HSTS enabled (prevents anyone from proxying your connection).