If possible, I would like to be able to see the SHA-256 PIN of the TLS certificate (according to RFC 7858, Section 4.2) used by the DoT/DoH server I am querying against when I use dnslookup (either in DEBUG mode or through it’s own option).

An implementation similar to how kdig shows this information when using the “-d” option would be perfect. For example:

Thank you for this utility! It is simple to use and excellent.