this makes no sense -- all tcp connections are already to the "bare ip address". dns lookup happens independently of the ip connection. in the case of a browser, your browser asks the local resolver (or with doh, remote nameserver) what the ip is for a given domain, then connects to that ip. I suppose it's possible your network has some strange setup that pokes holes through the firewall based on dns requests, but that would be obscenely expensive both computationally and financially.