CheckDNS needs this so domain files with CAA records can be reconciled instead of failing the zone check.
Co-authored-by: Cursor <cursoragent@cursor.com>
Callers get a session API, typed RR builders, and BIND testcontainer proof so CheckDNS can stay off the DNS wire.
Co-authored-by: Cursor <cursoragent@cursor.com>