diff --git a/agent.py b/agent.py
index 7428f97..a66deb7 100644
--- a/agent.py
+++ b/agent.py
@@ -1061,7 +1061,7 @@ def _unsafe_ip(ip: ipaddress._BaseAddress) -> bool:
     return bool(ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_multicast or ip.is_reserved or ip.is_unspecified)
 
 
-async def _validate_endpoint_target(url: str, allowlist: list[str]) -> str | None:
+def _validate_endpoint_metadata(url: str, allowlist: list[str]) -> str | None:
     parsed = urlparse(url)
     if parsed.scheme != "https" or not parsed.hostname:
         return "endpoint URL must be absolute https with a hostname"
@@ -1072,6 +1072,15 @@ async def _validate_endpoint_target(url: str, allowlist: list[str]) -> str | Non
         _validate_hostname(host)
     except ValueError as exc:
         return str(exc)
+    return None
+
+
+async def _validate_endpoint_target(url: str, allowlist: list[str]) -> str | None:
+    metadata_error = _validate_endpoint_metadata(url, allowlist)
+    if metadata_error:
+        return metadata_error
+    parsed = urlparse(url)
+    host = parsed.hostname.lower().rstrip(".")  # type: ignore[union-attr]
     try:
         infos = await asyncio.to_thread(socket.getaddrinfo, host, parsed.port or 443, type=socket.SOCK_STREAM)
     except socket.gaierror as exc: