The ipaclient role is able to configure the DNS resolver before deploying the IPA client. This is enabled using the variables

ipaclient_configure_dns_resolver=yes
ipaclient_dns_servers=<DNS server IP>

This is also working for DOT with the IPA DNS server as long as the relaxed policy is used. 

Using the enforced policy requires to configure the DNS resolver in a different way.

The goal will be to not simply copy the CA over to the client host, but instead to have a more secure solution that for example uses certificates with limited validity.

New variables will be needed like for example

ipaclient_dot_servers=<DOT server IP>