DNSSEC is recommended and mandatory from Release 26.03.
DANE is now default. It should be used for certificate pinning (but not as full PKI replacement ... yet).