New Relic Synthetics DNS resolver selection: limits of built-in DNS timing and certificate checks

Goal

I want to use New Relic Synthetics Ping and API tests to monitor a service whose DNS behavior differs between public resolvers and our internal split-DNS setup. The goal is to measure DNS lookup time and validate SSL certificates as seen from a specific resolver, so that certificate-expiry and DNS-latency alerts reflect the same resolution path our users take.

Constraints and uncertainty

From the documented behavior, Synthetics reports a DNS time metric for each check and validates the target's SSL certificate (expiry, hostname match, chain trust) at runtime. However, the DNS resolution appears to use the resolver configured in the Synthetics runner environment, and I cannot find any documented option to point a Ping or API test at a custom DNS server such as 8.8.8.8 or an internal resolver.

This leaves two gaps: first, whether the reported DNS time is meaningful for diagnosing propagation or split-DNS issues; second, whether certificate validation could be silently skipped when a monitor fails to connect, causing expiry alerts to be missed.

Questions

• Is there any supported way to influence which DNS resolver a Synthetics Ping or API test uses, or is the runner's resolver fixed by design?
• If a scripted monitor performs its own lookup (e.g., via Node's dns.resolve()), does the built-in DNS time metric still reflect only the runner's resolver?
• Does a connection failure skip the SSL certificate check entirely, and if so, what is the recommended way to ensure expiry alerts still fire?