This domain is live and hardened. The instrument and its documentation are being prepared.
Eight controls, one truth-chain: DNSSEC, DANE, SPF, DKIM, DMARC, MTA-STS, CAA, CDS/CDNSKEY — each verdict carries a re-derivable SHA3-512 seal. The measurement is free and cannot be shelved; the queried domain's data is public DNS, never a person's.