systemd-resolved DNS-over-TLS: Detecting Silent Downgrade in Opportunistic Mode
Goal Determine whether systemd-resolved silently falls back from DNS-over-TLS to plain DNS when a certificate fails validation while operating in opportunistic mode. Constraints In opportunistic mode, a TLS handshake or certificate validation error produces the same observable result as a resolver that never offers DoT, so the host never sees a visible error