In theory, if the receiving end enforces TLS and if the sending end checks that the certificate is valid for the domain, you don't need to trust the DNS or the

In theory, if the receiving end enforces TLS and if the sending end checks that the certificate is valid for the domain, you don't need to trust the DNS or the registrar. But nobody does that, and you still have to trust the sender.