Document the package, exported constants, and remaining helpers.

godoc now covers ActionAdd/ActionDelete, internal helpers, and UDP-then-TCP UPDATE behaviour.

Co-authored-by: Cursor <cursoragent@cursor.com>

client.go

@@ -8,9 +8,9 @@ import (
 
 // TSIG is caller-supplied key material. go-dns does not generate keys.
 type TSIG struct {
-	Name      string
-	Algorithm string
-	Secret    string
+	Name      string // key name presented to BIND
+	Algorithm string // BIND algorithm name, e.g. hmac-sha256
+	Secret    string // base64 secret from the Key File
 }
 
 // Client is a session against one nameserver and zone, authenticated with TSIG.
@@ -39,6 +39,7 @@ func NewClient(server, zone string, key TSIG) (*Client, error) {
 	return &Client{server: addr, zone: strings.TrimSpace(zone), tsig: key}, nil
 }
 
+// validateTSIG requires name, algorithm, and secret, and an ASCII key name.
 func validateTSIG(key TSIG) error {
 	if strings.TrimSpace(key.Name) == "" {
 		return fmt.Errorf("TSIG name is required")
@@ -55,6 +56,7 @@ func validateTSIG(key TSIG) error {
 	return nil
 }
 
+// withDNSPort appends :53 when server has no port.
 func withDNSPort(server string) (string, error) {
 	host := strings.TrimSpace(server)
 	if _, _, err := net.SplitHostPort(host); err == nil {
@@ -67,6 +69,7 @@ func withDNSPort(server string) (string, error) {
 	return net.JoinHostPort(host, "53"), nil
 }
 
+// asciiName rejects empty or non-ASCII DNS names.
 func asciiName(label, name string) error {
 	trimmed := strings.TrimSpace(name)
 	if trimmed == "" {