For dns.controld.com premium resolvers we synthesized per-resolver IPv6 addresses by encoding the resolver ID into the 2606:1a40::/48 range, but those are legacy plaintext-DNS (port 53) endpoints that refuse TCP :443. DoH now dials Control D's shared anycast IPs (the resolver ID stays in the URL path), fixing SERVFAIL on IPv6-only/NAT64 networks where the v4 anycast fallback isn't reachable. Fixes #20430 Signed-off-by: Brendan Creane <bcreane@gmail.com>