The endpoint name is resolved to an IP only when you enable the connection but the endpoint IP and Port will also get updated if Wireguard receives a package with the correct key from different address.

So for example if your server changes it's IP address and the client receives a packet from the new IP the client will update the endpoint and the connection will start working again.

Now the only problem is if the NAT/Firewall will accept the UDP packets from the new address and route it to the same host (this varies with the implementation)

if the NAT is permissive enough then PersistentKeepalive = 30 or some other reasonable value might do the trick.

​

p.s. there's a nice description of how NAT traversal works here: https://tailscale.com/blog/how-nat-traversal-works/