Use separate DNS servers to support the devices in the IP telephony VLAN or VLANs and the devices in the rest of the data network.
Enable DNSSec encryption on all DNS servers and enable DNS resolvers with DNSSec support on all DNS clients in the network. This solution, however, means that the DNS server or servers transmit the entire list of names within a DNS zone when it queries or responds to DNS requests. Such a transmission may be unlawful in some countries and could enable an attacker to determine the existence of the DNS clients in the zone.