UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36

Steps to reproduce the problem:
Now that HTTP Public Key Pinning has shown it's weaknesses in practical use, I think it's time to reevaluate the issue  https://crbug.com/50874  for implementing DNSSEC with DANE/TLSA.
Also dane is getting more widely adopted (ok, currently only for mail servers) and does increase security by a huge factore.
This would also allow using self signed certificates for tls without losing security, as the chain of trust can be validated through dns instead of through X.509. And it grants much more flexibility than HTTP Public Key Pinning did and the changes for long user/visitor lockouts are also much lower.

What is the expected behavior?
DANE/TLSA being validated and used to validate the tls certificate instead/together (depending on mode) of the X.509 Trust chain, if also DNSSEC/DNS-over-TLS/DNS-over-HTTPS is present/used for that domain.

What went wrong?
DANE/TLSA does not seem to be validated.

Did this work before? N/A 

Chrome version: 70.0.3538.110  Channel: n/a
OS Version: 10.0
Flash Version: