Zig DNS Resolver and TLS Client: Automatic Hostname Propagation for SNI and Verification

Answer: No automatic propagation; keep verifyHostname false by default

The Zig standard library deliberately separates DNS resolution from TLS configuration. std.net.DNSLookup returns only IP addresses, and std.tls.connect requires the caller to supply the hostname for SNI and to set verifyHostname. Making the resolver automatically feed the hostname into the TLS layer would hide dependencies, break code that connects via raw IP addresses or uses custom SNI values, and contradicts the current design consensus in the Zig repository.

Confirmed facts

1. std.net.DNSLookup discards the original hostname after resolving to std.net.Address.
2. std.tls.TLSContext has fields server_name (SNI) and verify_hostname; both default to empty/false.
3. No API in Zig 0.13.x or the 0.14 development branch propagates the DNS hostname to TLS automatically.
4. GitHub discussions (e.g., #16847, #19203) show agreement against implicit propagation because it would limit flexibility for IP‑only connections, alternative names, and custom verification logic.

Steps for a secure connection (current recommended pattern)

1. Resolve the hostname: const addr = try std.net.DNSLookup.lookup(&allocator, "example.com", .default);
2. Keep the original hostname string (e.g., const hostname = "example.com";).
3. Create a std.tls.TLSContext, set .server_name = hostname and .verify_hostname = true (after configuring a trusted CA store).
4. Call std.tls.connect with the resolved address and the TLS context.

Opt‑in API suggestion

To avoid repeating the manual steps, a convenience wrapper could be added (e.g., std.net.tlsConnectHostname) that:

• takes a hostname string,
• performs DNS lookup internally,
• builds a TLS context with server_name and verify_hostname = true,
• returns the connected stream.

Such a wrapper would live in std.net or a higher‑level client module, leaving the low‑level DNSLookup and TLSContext unchanged so existing code continues to work unchanged.