Minimal DNAME support
Search for TLSA RRs at rname and failing that qname, use whichever was found as the TLSA base domain for certificate matching.