CheckDNS needs this so domain files with CAA records can be reconciled instead of failing the zone check.
Co-authored-by: Cursor <cursoragent@cursor.com>
Callers get a session API, typed RR builders, and BIND testcontainer proof so CheckDNS can stay off the DNS wire.
Co-authored-by: Cursor <cursoragent@cursor.com>
Create bind-tsig-configuration.md for allow-update and allow-transfer
setup. Link from README and project spec; extend .gitignore for .env files.
Record implementation decisions for change C-00001-setup-project.
Co-authored-by: Cursor <cursoragent@cursor.com>