DNSSEC is recommended and mandatory from Release 26.08.
DANE is now default. It should be used for certificate pinning (but not as full PKI replacement ... yet).