diff --git a/CHANGELOG.md b/CHANGELOG.md
index de1a36dc..e0ae0e78 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -36,9 +36,11 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
   - `SearchSnippet/get`: incorrect response structure.
   - `Thread/changes`: emit a container delete when a thread becomes empty.
   - `VacationResponse/set`: incorrect singleton handling.
+- DANE: Improper `TLSA` record validation (#2328).
 - OIDC: Add default domain name to groups that are not email addresses.
 - RocksDB: Enable blob garbage collection to reclaim disk space from deleted blobs.
 - Sieve: `include` statements ignore capitalisation of sub-script names (#1643)
+- Troubleshoot tool: Use the configured source IP address when connecting to remote servers (#2867).
 
 ## [0.16.9] - 2026-06-15
 
diff --git a/crates/http/src/api/diagnose.rs b/crates/http/src/api/diagnose.rs
index ee6bac87..55443b20 100644
--- a/crates/http/src/api/diagnose.rs
+++ b/crates/http/src/api/diagnose.rs
@@ -18,7 +18,7 @@ use smtp::outbound::{
     client::{SmtpClient, StartTlsResult},
     dane::{dnssec::TlsaLookup, verify::TlsaVerify},
     error::ClientError,
-    lookup::{DnsLookup, ToNextHop},
+    lookup::{DnsLookup, SourceIp, ToNextHop},
     mta_sts::{lookup::MtaStsLookup, verify::VerifyPolicy},
 };
 use std::{
@@ -218,6 +218,7 @@ async fn delivery_diagnose(
     };
 
     let local_host = &server.core.network.server_name;
+    let conn_strategy = server.get_connection_or_default("default", 0);
 
     tx.send(DeliveryStage::MxLookupStart {
         domain: domain.to_string(),
@@ -472,7 +473,13 @@ async fn delivery_diagnose(
                 .await?;
 
             let now = Instant::now();
-            match SmtpClient::connect(SocketAddr::new(remote_ip, 25), timeout, 0).await {
+            let connect = if let Some(ip_host) = conn_strategy.source_ip(remote_ip.is_ipv4()) {
+                SmtpClient::connect_using(ip_host.ip, SocketAddr::new(remote_ip, 25), timeout, 0)
+                    .await
+            } else {
+                SmtpClient::connect(SocketAddr::new(remote_ip, 25), timeout, 0).await
+            };
+            match connect {
                 Ok(mut client) => {
                     tx.send(DeliveryStage::ConnectionSuccess {
                         elapsed: now.elapsed_ms(),
@@ -586,6 +593,7 @@ async fn delivery_diagnose(
                         if let Err(err) = dane_policy.verify(
                             0,
                             hostname,
+                            &[hostname],
                             client.tls_connection().peer_certificates(),
                         ) {
                             tx.send(DeliveryStage::DaneVerifyError {