Agreed, the best case is when you have e2ee (which unfortunately is not in core) and DNSSEC. I must admit to being biased against using DNSSEC alone because a

Agreed, the best case is when you have e2ee (which unfortunately is not in core) and DNSSEC. I must admit to being biased against using DNSSEC alone because a malicious XMPP server can still inspect and/or modify queries and responses. By self-hosting you mitigate, but without e2ee the server is still trusted (in the threat-model).