check all dns checkpoint urls

check each dns checkpoint url and use the records from the first
two that match (and dnssec is okay), if any.