A DNS ingress that extracts SNI prefixes from encrypted DNS traffic (DoT / DoQ / DoH3) and rewrites upstream SNI for tenant-aware routing.