Catch 22. To know the server wants to exclusively use DANE you must learn that in a secure way, like via DNSSEC, but the point of DANE is to not do interactive

Catch 22. To know the server wants to exclusively use DANE you must learn that in a secure way, like via DNSSEC, but the point of DANE is to not do interactive DNSSEC queries. I guess if you're publishing an intent to use DANE stapling exclusively via DNS, then you could have tools that crawl the CT logs looking for CA issuances for domains that claim they don't want them. Though maybe detecting an attack in that way isn't worth much.