How can I diagnose DNS resolution and TLS certificate validation failures in Emacs when retrieving packages from HTTPS archives?

When Emacs attempts to fetch package archives over HTTPS using the built-in url library, it relies on system DNS resolution and GnuTLS for certificate validation. If either step fails, Emacs aborts the operation and reports a generic TLS error, making it hard to pinpoint whether the problem lies in name resolution or in the certificate chain.

The goal is to determine whether the failure originates from DNS lookup or from certificate validation, and to identify the Emacs facilities that expose the intermediate results without altering the system configuration.

What variables or functions can be inspected to see the resolved IP address before the TLS handshake? How can one enable detailed logging for both DNS and GnuTLS verification within Emacs? Is there a supported way to specify an alternative CA bundle for Emacs to use during validation?