This is the idea behind DANE :) https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication

This is the idea behind DANE :) https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na... Effectively, you’d serve a self-signed certificate, then use DNSSEC to state that the origin can use the self-signed cert. Then clients can use that without showing warnings. However, it does rely on DNSSEC not being a total failure, so not likely to end up in widespread use anytime soon unfortunately. Also, given the more recent growth of alternative solutions to the problems DANE solves, like Let’s Encrypt and CAA DNS records, I’m not sure we’re likely to see much more work being done on it sadly.