You can add IP addresses of the NTP servers being used in the captive-portals.txt file, which serves records even before the operating system considers a networ

You can add IP addresses of the NTP servers being used in the captive-portals.txt file, which serves records even before the operating system considers a network interface as active. Or add cert_ignore_timestamp=true to the main configuration file. Initially, cert expiration won't be checked, but as soon as a DNS server will be reachable, this feature will automatically disable itself. This is for dnscrypt-proxy. Alternative clients may have something similar.