Comment by tptacek

There's a whole design space of options here, one of the simpler ones being just checking via the registrar, using a protocol like RDAP. You could also use the DNS for this, but not require the entire zone to be encrypted (you'd be designing a new protocol, but that's what we have to do anyways, since DNSSEC is a dead letter).