DNS resolves a name to a destination; TLS still needs to verify that the application reached the intended service.
Evaluation approach
Validate certificates against the expected hostname and test network and resolver changes.
Application example
Switching between public Wi-Fi and cellular must not cause a silent fallback to HTTP.
Limits and considerations
Encrypted DNS does not fix application authentication or authorization errors.
Managing domain changes
Assess older clients' connection and certificate expectations during API-domain migrations. Redirects must not silently broaden the trust boundary.
Checks and decisions
- Use expected hostnames
- Remove insecure fallbacks
- Test network transitions
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.