diff --git a/agent.py b/agent.py
index 4b8485a..7428f97 100644
--- a/agent.py
+++ b/agent.py
@@ -573,15 +573,20 @@ class CustomerIntegrationEngineer(A2AAgent[CustomerIntegrationEngineerConfig, No
         network_calls = 0
         warnings: list[str] = []
         for test in request.endpoint_tests:
-            validation = await _validate_endpoint_target(test.url, request.external_host_allowlist)
             idem = test.idempotency_key or _plan_digest({"integration_id": request.integration_id, "test": test.model_dump(mode="json")})[:32]
+            if dry_run or not request.allow_network:
+                validation = _validate_endpoint_metadata(test.url, request.external_host_allowlist)
+                if validation:
+                    step_results.append(AcceptanceStepResult(name=test.name, status="blocked", attempts=0, detail=validation, idempotency_key=idem))
+                    warnings.append(validation)
+                else:
+                    step_results.append(AcceptanceStepResult(name=test.name, status="skipped", attempts=0, detail="dry_run/default safe mode: endpoint metadata was validated but no DNS lookup or external request was sent", idempotency_key=idem))
+                continue
+            validation = await _validate_endpoint_target(test.url, request.external_host_allowlist)
             if validation:
                 step_results.append(AcceptanceStepResult(name=test.name, status="blocked", attempts=0, detail=validation, idempotency_key=idem))
                 warnings.append(validation)
                 continue
-            if dry_run or not request.allow_network:
-                step_results.append(AcceptanceStepResult(name=test.name, status="skipped", attempts=0, detail="dry_run/default safe mode: external request was validated but not sent", idempotency_key=idem))
-                continue
             if live_network_block:
                 step_results.append(AcceptanceStepResult(name=test.name, status="blocked", attempts=0, detail=live_network_block, idempotency_key=idem))
                 warnings.append(live_network_block)