@Gargron @selea

Oh and 0) check if DNS response is DNSSEC-authenticated

For Synapse I can actually come up with a PR as it's Python, not sure about Mastodon.