Standard libpq supports an option hostaddr which allows the dialer to avoid a DNS lookup. More importantly for my case, it allows a connection with sslmode=verify-full even though my connection is going via a local SSH tunnel to the remote Postgres server.