Hi, virt-manager.org has DNSSEC enabled; that's awesome! You're 99% of the way there to enabling DANE, you just need to create a TLSA resource record. Would you please consider doing that? Let me know how I can help.
Thanks
signature.asc
Description: This is a digitally signed message part
smime.p7s
Description: S/MIME cryptographic signature