{
  "context": "Evaluates how the solution uses dnspython to prefer DDR-discovered encrypted resolvers, configure DoH/DoQ/DoT transports with custom security settings, and run queries through that resolver. Checks focus on correct API usage and ordering rather than general coding style.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "DDR attempt",
      "description": "Invokes dns.resolver.try_ddr (or the async counterpart) with the service name and bootstrap IP to discover encrypted resolver endpoints before falling back.",
      "max_score": 25
    },
    {
      "name": "Encrypted nameservers",
      "description": "Builds dns.nameserver.DoHNameserver, dns.nameserver.DoQNameserver, and dns.nameserver.DoTNameserver objects from provided endpoints and assigns them to the Resolver instead of plain host strings.",
      "max_score": 25
    },
    {
      "name": "TLS/HTTPS options",
      "description": "Applies provided security settings by passing an ssl.SSLContext/SNI override via tls_context to DoT/DoQ constructors and configuring HTTPS session/CA options on DoH nameservers.",
      "max_score": 20
    },
    {
      "name": "Fallback order",
      "description": "Implements DoH->DoQ->DoT preference when DDR returns nothing, ordering resolver.nameservers accordingly and rotating only among encrypted transports.",
      "max_score": 15
    },
    {
      "name": "Encrypted queries",
      "description": "Executes A/AAAA lookups through dns.resolver.Resolver.resolve (or resolve_address) against the configured encrypted nameservers and avoids plaintext dns.query.udp/tcp calls.",
      "max_score": 15
    }
  ]
}