Zig DNS Resolver and TLS Client: Automatic Hostname Propagation for SNI and Verification

When developing a network client in Zig, a programmer typically resolves a hostname with std.net.DNSLookup and then establishes a TLS connection using std.tls.connect. The DNS resolver returns the IP address but does not automatically supply the resolved host name to the TLS layer for SNI or certificate hostname verification. The application must manually pass the same host string to std.tls.TLSContext and set the verifyHostname flag to enable validation. This separation creates a potential mismatch and leaves secure defaults to the caller, which is currently under discussion in the Zig repository.

• Should the DNS resolver automatically propagate the resolved hostname as the SNI value and enable hostname verification?
• Would it be appropriate to make verifyHostname default to true when a TLS context is created after a DNS lookup?
• What API changes would be required to opt‑in or opt‑out of this behavior without breaking existing code?