How a device finds encrypted DNS by itself

Encrypted DNS needs more than an IP address: a hostname, port, and protocol. DDR (Discovery of Designated Resolvers) lets a resolver publish these details to any device already talking to it. A device queries `_dns.resolver.arpa` and gets back the encrypted endpoints it offers, along with their IPs. This works for devices already on encrypted DNS (upgrading protocols) and for plain-DNS devices like TVs and consoles. However, upgrades from plain DNS are opportunistic and can be blocked by network operators. Direct configuration remains stronger where possible.