get_dns_diagnostics

Roll up DNS health for one owned domain in a single call: it composes the authoritative zone read (what your zone says), the public-resolver lookup (what the internet actually returns) and the registrar DNSSEC read, and returns {verdict, summary, findings[], signals:{zone, public, dnssec}, notes} — a ranked findings[] (each {severity, title, evidence, recommendation}) that names the mismatches: root A not pointing here, NS the registry publishes differing from the zone, a domain that does not resolve publicly, missing MX. verdict is the most severe finding (critical|warning|info|ok). This is the DNS side only: for the website use get_website_diagnostics, for mail use get_email_diagnostics; for one raw record set use list_dns_records. It changes nothing.