🐛 `gov.tools` domain inaccessible by Secure DNS (DNSSEC)

### Area

Other

### Domain

gov.tools

### Which wallet were you using?

N/A

### Context

`gov.tools` and its subdomains work fine through regular DNS, but DNS over TLS (DoT) [through Cloudflare](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-tls) and [through Quad9](https://quad9.net/support/faq/#dns_tls) returns a result seen as an immediate hostname lookup failure by web browsers.

This likely happens around the domains being redirected a couple times to arbitrary-looking addresses: so either it looks like a "hacked" site (and could therefore be blocklisted in both places) or there isn't a properly configured reverse lookup for the address [as I once reported for another web site here](https://community.cloudflare.com/t/cloudflare-dns-missing-popular-site-blocklisted/732950/6):

```
$ dig gov.tools
;; ANSWER SECTION:
gov.tools. 300 IN CNAME z623632c1-z3c24a074-gtw.z1add53af.slab.sh.
;; ADDITIONAL SECTION:
z623632c1-z3c24a074-gtw.z1add53af.slab.sh. 300 IN CNAME a671ab83a253f4cc58d99d5a52072ff1-fd222fd9900ea9af.elb.eu-west-1.amazonaws.com.
a671ab83a253f4cc58d99d5a52072ff1-fd222fd9900ea9af.elb.eu-west-1.amazonaws.com. 60 IN A 54.73.234.213
```

There appears no proper workaround for this, since the only way I've found to get to `gov.tools` is *not* to use this commonly used secure networking configuration which is especially appropriate for cryptocurrency users & advocates.

### Steps to reproduce

1. Find a real Ubuntu 24.04 system.
- Ubuntu 24.04: since, as of this most common distro & version, DoT is built in
- real: since it's unknown if the TCP/IP stack in a virtual machine would fully implement DoT
2. Edit `/etc/systemd/resolved.conf` to use (for example) DoT through CloudFlare by setting these options:
```
DNS=1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001
DNSSEC=yes
DNSOverTLS=yes
```
3. Restart the `systemd` resolver: `systemctl restart systemd-resolved`
4. Observe that browsers won't open web site at `gov.tools` or subdomains (e.g. Documentation).
5. (optional) Repeat the above with Quad9 `DNS=` settings and observe the same thing happens:
```
DNS=9.9.9.9 149.112.112.112 2620:fe::fe 2620:fe::9
```

### Actual behavior

DNS records visible from `dig gov.tools` ultimately point to an `A` record (by dereferencing 2 `CNAME` records) but that doesn't make it through the resolver when DoT is being used. (TL;DR... web site not load!)

Subtly the behaviour could well be the problem pointed out here, indicating some care must be taken to configure DNS domains to make reverse lookups possible that are necessary for secure DNS configurations to authenticate that the domain record & its addresses are not being spoofed; as explained here (this is a follow-up post of the forum thread above): https://community.cloudflare.com/t/cloudflare-dns-missing-popular-site-blocklisted/732950/7

### Expected behavior

Web site works with DNS over TLS just as it does without it. Cryptocurrency holders, dApp users, Cardano dReps, and developers / engineers / managers / writers in the field are happy to be able to use DoT continuously: to avoid domain censorship by their ISPs / governments as well as surveillance or exploitation through their DNS histories.