@filippo @cks As an aside, I think encrypted client hello might be the long term solution. If a firewall cannot inspect anything at all, ossification can’t happen.

Then it’s “just” a matter of making DNSSEC mandatory everywhere and refusing exceptions for anything that isn’t a private domain (.internal, .corp.arpa, .home.arpa, etc).