dot upstreams: per-upstream tls_name for sni and cert verification by dns name

src/upstream/dot_client_live_test.zig

@@ -26,10 +26,14 @@ const query_bytes =
     "\x07example\x03com\x00\x00\x01\x00\x01";
 
 /// This machine's IPv6 egress is dead and upstream name resolution is out of
-/// scope, so the documented anycast IPv4 literal is used. Cloudflare's
-/// certificate carries 1.1.1.1 as an IP SAN, so full verification still applies.
+/// scope, so the documented anycast IPv4 literal is used.
 const upstream_url = "tls://1.1.1.1:853";
 
+/// The name Cloudflare publishes for this endpoint. Without it the handshake is
+/// `error.CertificateHostMismatch`: `std.crypto.Certificate` matches dNSName
+/// SANs only, so the IP SAN on the leaf certificate is never consulted.
+const upstream_tls_name = "one.one.one.one";
+
 const Outcome = union(enum) {
     exchange: anyerror!usize,
     expiry: std.Io.Cancelable!void,
@@ -47,6 +51,7 @@ fn runExchange(io: std.Io, params: Params) anyerror!usize {
     const endpoint: transport.Endpoint = try .parse(upstream_url);
     var client: dot_client.DotClient = .init(
         endpoint,
+        upstream_tls_name,
         params.gpa,
         params.bundle,
         params.bundle_lock,