NetBox DNS-over-TLS sync fails certificate validation against an internal CA

I am evaluating NetBox's DNS integration (the netbox-dns plugin) to sync records to an external DNS server that only accepts DNS-over-TLS. The endpoint uses a certificate issued by our internal private CA, and I need to understand how NetBox validates that certificate before committing to this design.

My understanding is that outbound validation is handled by the Python requests library and its default certifi CA bundle, which would not include a private CA. I have seen references to both the REQUESTS_CA_BUNDLE environment variable and a NetBox configuration option for a custom CA bundle, but it is unclear which one NetBox's DNS sync path actually honors, and whether the setting applies consistently to the web process and background workers that may perform the sync.

Assuming NetBox 4.x with the plugin current as of late 2026, I would like to confirm the intended configuration surface rather than work around validation by disabling it.

Specifically:

• Which mechanism is the supported way to make NetBox trust a private CA for outbound DoT connections: REQUESTS_CA_BUNDLE, a NetBox configuration setting, or both?
• After changing the CA bundle, which services must be restarted for the new trust store to take effect for DNS sync jobs?
• What log output confirms a validation failure versus a silent sync skip, so the failure mode is observable?