The DNS lookup takes place before the HTTPS connection, but only the domain is looked up. In your example, all the DNS server would know is that someone looked up the address for
example.com. It wouldn't even know that a browser was involved.
The encrypted connection is indeed created before any data is sent; this includes the
Host: HTTP header which tells the server the domain part of the URL. This is important because many websites can be presented on a single IP address, and the webserver has no way of knowing which was requested before SSL negotiation takes place. Modern browsers implement SNI, which sends the domain name (and only the domain name) outside of the encrypted connection.
The quote you've included in your own answer is almost right: an attacker can see the far end's IP address, but can't know the domain name for certain unless SNI is in use.