Unicast announcements directly to the proxy over TLS should ensure service is from local link

[pusateri]

In IPv6, this means the link local IPv6 address should be the target address for _dns-updateproxy-tls._tcp.<subdomain>.

For IPv4, other checks such as the correct incoming interface, the IP header TTL is 1, the source address is from the local link, etc. should be used to ensure the service is on the local link.