Previous value: -"Domain names to query. Up to 10 per call."New value: +"Domain names to query. The first 10 entries are queried; up to 100 are accepted, and entries past the 10th come back unqueried and verbatim in deferred_domains, to resend in another call. Each entry is read as one name: surrounding whitespace and letter case are ignored, a scheme, port, path, query, or fragment is dropped, and an internationalized name is converted to its ASCII form (\"münchen.de\" → \"xn--mnchen-3ya.de\"); a trailing dot and underscore labels are kept. An entry that is not a domain name — an IP address, a user name before \"@\", a bad port, or a malformed label — gets its own result with \"error\" set and is never queried; the other entries still run."

Previous value: -"A domain name to query (e.g., \"github.com\", \"api.example.com\")."New value: +"A domain name to query (e.g., \"github.com\", \"_dmarc.example.com\"). A URL or a host:port is reduced to its host."

Previous value: -10New value: +100

Previous value: -"DNS record types to resolve. Defaults to A, AAAA, MX, and TXT. An empty array uses the same defaults. Add NS to check nameserver delegation. Add CNAME when investigating redirect chains."New value: +"DNS record types to resolve. Defaults to A, AAAA, MX, and TXT. An empty array uses the same defaults. A type listed more than once is queried once. Add NS to check nameserver delegation. Add CNAME when investigating redirect chains. Add CAA when a certificate will not issue or renew: it lists the certificate authorities allowed to issue for the name. CAA is reported for the exact name only; a CA that finds none there checks the parent domains, so no CAA at a subdomain does not mean any CA may issue. Add SOA to compare zone serials across resolvers. SOA answers only at a zone apex, so a name below it returns nodata (a name that is a CNAME returns the SOA of its target). A serial difference means a zone change has not reached every resolver only when those resolvers report the same primary nameserver; a different primary means more than one DNS provider serves the zone."

Previous value: -[
-  "A",
-  "AAAA",
-  "CNAME",
-  "MX",
-  "TXT",
-  "NS"
-]New value: +[
+  "A",
+  "AAAA",
+  "CNAME",
+  "MX",
+  "TXT",
+  "NS",
+  "CAA",
+  "SOA"
+]

Previous value: -"Resolver IP addresses to query. Defaults to Google (8.8.8.8), Cloudflare (1.1.1.1), and Quad9 (9.9.9.9). An empty array uses the same defaults. Add custom resolvers to test resolver-specific behavior. Each must be an IP literal, not a hostname; resolvers in private, loopback, or cloud-metadata ranges are rejected unless DEVOPS_STATUS_ALLOW_PRIVATE_TARGETS=true."New value: +"Resolver IP addresses to query. Defaults to Google (8.8.8.8), Cloudflare (1.1.1.1), and Quad9 (9.9.9.9). An empty array uses the same defaults. Add custom resolvers to test resolver-specific behavior. A resolver listed more than once — the same address and port, however written (\"8.8.8.8\" and \"8.8.8.8:53\") — is queried once, under its first spelling. The first 5 distinct resolvers are queried; up to 20 entries are accepted, and the rest come back unqueried in deferred_resolvers, to resend with the same domains in another call. Each must be an IP literal, not a hostname; resolvers in private, loopback, or cloud-metadata ranges are rejected unless DEVOPS_STATUS_ALLOW_PRIVATE_TARGETS=true."

Added value: +20

Previous value: -"Query timeout per domain+resolver combination in milliseconds. Defaults to the DEVOPS_STATUS_DNS_TIMEOUT_MS env var (3000 when unset)."New value: +"Time limit in milliseconds for each domain+resolver pair, covering every requested record type and any retry over TCP. A resolver that has not answered within it reports \"timeout\" for the unanswered types. At least 1000; a value over 10000 is served as 10000, and the notice says so. Defaults to 3000 unless the server is configured otherwise."

Previous value: -10000New value: +9007199254740991

Previous value: -[
-  {
-    "not": {
-      "required": [
-        "error"
-      ]
-    },
-    "required": [
-      "results"
-    ]
-  },
-  {
-    "required": [
-      "error"
-    ]
-  }
-]New value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "results",
+      "deferred_domains",
+      "deferred_resolvers"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Added value: +{
+  "description": "Domain entries past the first 10, not queried on this call, verbatim and in input order. Resend them in another call. Empty when every entry was queried.",
+  "items": {
+    "description": "A submitted domain entry, exactly as sent.",
+    "type": "string"
+  },
+  "type": "array"
+}

Added value: +{
+  "description": "Distinct resolvers past the first 5, not queried on this call, verbatim and in input order. Resend them with the same domains in another call. Empty when every resolver was queried.",
+  "items": {
+    "description": "A submitted resolver entry, exactly as sent.",
+    "type": "string"
+  },
+  "type": "array"
+}

Previous value: -"Machine-readable failure mode. Declared by this tool: `invalid_domain`: A domain string contains a protocol prefix or invalid format. `target_blocked`: A resolver is a private, loopback, or otherwise non-public address, or is not an IP literal at all. Other values are possible when a failure originates below the handler."New value: +"Machine-readable failure mode. Declared by this tool: `target_blocked`: A resolver is a private, loopback, or otherwise non-public address, or is not an IP literal at all. Other values are possible when a failure originates below the handler."

Previous value: -[
-  "invalid_domain",
-  "target_blocked"
-]New value: +[
+  "target_blocked"
+]

Added value: +{
+  "description": "Present when the call was served at a bound: domains or resolvers past the per-call cap, named in deferred_domains and deferred_resolvers, or a timeout_ms over 10000 that was served as 10000. Absent otherwise.",
+  "type": "string"
+}

Previous value: -"The domain that was queried."New value: +"The domain name that was queried, as read from the submitted entry (lowercase, ASCII, no scheme, port, or path). For an entry that is not a domain name, the submitted string as given."

Previous value: -"Set only when the domain could not be queried at all. Either it was rejected before any query (for example a private, loopback, or cloud-metadata target) and \"resolver_results\" is empty, or every resolver failed and none returned records, in which case each failing resolver is named with its own outcome (\"8.8.8.8: SERVFAIL on A; 1.1.1.1: NXDOMAIN on A\") so a split result stays visible. Null when at least one resolver answered; per-resolver failures are still in \"resolver_results\" and \"flags\"."New value: +"Set only when the domain could not be queried at all. Either it was rejected before any query — the entry is not a domain name (the message names the entry and the accepted shapes), or it is a private, loopback, or cloud-metadata target — and \"resolver_results\" is empty, or every resolver failed and none returned records, in which case each failing resolver is named with its own outcome (\"8.8.8.8: SERVFAIL on A; 1.1.1.1: NXDOMAIN on A\") so a split result stays visible. Null when at least one resolver answered; per-resolver failures are still in \"resolver_results\" and \"flags\"."

Previous value: -"Resolved records from a single resolver, keyed by record type (A, AAAA, CNAME, MX, TXT, NS). Taken from the primary resolver (first in \"resolvers\"), or from the first resolver that returned records when the primary returned none. Read \"records_source\" for which resolver these came from, and \"resolver_results\" for the full per-resolver picture. This is also the reference set the per-resolver answers are reported against: a resolver that returned exactly these values for a type names it in \"records_same_as_domain\" rather than repeating them."New value: +"Resolved records from a single resolver, keyed by record type (A, AAAA, CNAME, MX, TXT, NS, CAA, SOA). Names carry no trailing dot; MX renders as \"<preference> <exchange>\", CAA as '<flags> <tag> \"<value>\"', and SOA as \"<primary nameserver> <hostmaster> <serial> <refresh> <retry> <expire> <minimum>\". Taken from the primary resolver (first in \"resolvers\"), or from the first resolver that returned records when the primary returned none. Read \"records_source\" for which resolver these came from, and \"resolver_results\" for the full per-resolver picture. This is also the reference set the per-resolver answers are reported against: a resolver that returned exactly these values for a type names it in \"records_same_as_domain\" rather than repeating them."

Previous value: -"Outcome for each requested record type, keyed by type. \"ok\" = records returned; \"nodata\" = the domain exists but has no record of this type; \"nxdomain\" = the domain does not exist (check for a typo, an expired registration, or a missing delegation); \"servfail\" = the resolver could not complete the query, commonly a DNSSEC validation failure; \"refused\" = the resolver declined; \"timeout\" = no answer within timeout_ms; \"error\" = any other failure, described in \"error\"."New value: +"Outcome for each requested record type, keyed by type. \"ok\" = records returned; \"nodata\" = the domain exists but has no record of this type; \"nxdomain\" = the domain does not exist (check for a typo, an expired registration, or a missing delegation); \"servfail\" = the resolver could not complete the query, commonly a DNSSEC validation failure; \"refused\" = the resolver declined the query or refused the connection; \"timeout\" = no answer within timeout_ms; \"error\" = any other failure, described in \"error\"."

Previous value: -"DNS record types to resolve. Defaults to A, AAAA, MX, and TXT. Add NS to check nameserver delegation. Add CNAME when investigating redirect chains."New value: +"DNS record types to resolve. Defaults to A, AAAA, MX, and TXT. An empty array uses the same defaults. Add NS to check nameserver delegation. Add CNAME when investigating redirect chains."

Previous value: -"Resolver IP addresses to query. Defaults to Google (8.8.8.8), Cloudflare (1.1.1.1), and Quad9 (9.9.9.9). Add custom resolvers to test resolver-specific behavior. Each must be an IP literal, not a hostname; resolvers in private, loopback, or cloud-metadata ranges are rejected unless DEVOPS_STATUS_ALLOW_PRIVATE_TARGETS=true."New value: +"Resolver IP addresses to query. Defaults to Google (8.8.8.8), Cloudflare (1.1.1.1), and Quad9 (9.9.9.9). An empty array uses the same defaults. Add custom resolvers to test resolver-specific behavior. Each must be an IP literal, not a hostname; resolvers in private, loopback, or cloud-metadata ranges are rejected unless DEVOPS_STATUS_ALLOW_PRIVATE_TARGETS=true."

Previous value: -"Set only when the domain could not be queried at all — every resolver failed and none returned records. Each failing resolver is named with its own outcome (\"8.8.8.8: SERVFAIL on A; 1.1.1.1: NXDOMAIN on A\") so a split result stays visible. Null when at least one resolver answered; per-resolver failures are still in \"resolver_results\" and \"flags\"."New value: +"Set only when the domain could not be queried at all. Either it was rejected before any query (for example a private, loopback, or cloud-metadata target) and \"resolver_results\" is empty, or every resolver failed and none returned records, in which case each failing resolver is named with its own outcome (\"8.8.8.8: SERVFAIL on A; 1.1.1.1: NXDOMAIN on A\") so a split result stays visible. Null when at least one resolver answered; per-resolver failures are still in \"resolver_results\" and \"flags\"."

Previous value: -"Human-readable observations that need attention: \"NXDOMAIN from 8.8.8.8, 1.1.1.1 on A, MX — the domain does not exist …\", \"Partial resolution on A records — 9.9.9.9 (nodata) returned nothing while 8.8.8.8 answered\", \"No MX records found\", \"CNAME detected — further records resolve via the CNAME target\". A value_variation disagreement is not flagged here — it is reported in \"propagation_discrepancies\" because it is normal for geo-steered domains."New value: +"Human-readable observations that need attention: \"NXDOMAIN from 8.8.8.8, 1.1.1.1 on A, MX — the domain does not exist …\", \"Partial resolution on A records — 9.9.9.9 (nodata) returned nothing while 8.8.8.8 answered\", \"No MX records found\", \"CNAME detected — further records resolve via the CNAME target\". A value_variation disagreement is not flagged here — it is reported in \"propagation_discrepancies\" because it is normal for geo-steered domains. Empty for a domain rejected before any query, whose reason is in \"error\"."

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

Added value: +[
+  "string",
+  "null"
+]

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

Added value: +[
+  "string",
+  "null"
+]

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

Added value: +[
+  "string",
+  "null"
+]

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +false

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "results"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Added value: +{
+  "additionalProperties": {},
+  "description": "Present when the call failed. Absent on success.",
+  "properties": {
+    "code": {
+      "description": "JSON-RPC error code for this failure.",
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "data": {
+      "additionalProperties": {},
+      "properties": {
+        "reason": {
+          "description": "Machine-readable failure mode. Declared by this tool: `invalid_domain`: A domain string contains a protocol prefix or invalid format. `target_blocked`: A resolver is a private, loopback, or otherwise non-public address, or is not an IP literal at all. Other values are possible when a failure originates below the handler.",
+          "examples": [
+            "invalid_domain",
+            "target_blocked"
+          ],
+          "type": "string"
+        },
+        "recovery": {
+          "additionalProperties": {},
+          "description": "Actionable next step for the caller.",
+          "properties": {
+            "hint": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "hint"
+          ],
+          "type": "object"
+        },
+        "retryable": {
+          "description": "Whether retrying may succeed.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "message": {
+      "description": "Human-readable description of what went wrong.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "code",
+    "message"
+  ],
+  "type": "object"
+}

Removed value: -[
-  "results"
-]

Previous value: -"Resolved records from a single resolver, keyed by record type (A, AAAA, CNAME, MX, TXT, NS). Taken from the primary resolver (first in \"resolvers\"), or from the first resolver that returned records when the primary returned none. Read \"records_source\" for which resolver these came from, and \"resolver_results\" for the full per-resolver picture."New value: +"Resolved records from a single resolver, keyed by record type (A, AAAA, CNAME, MX, TXT, NS). Taken from the primary resolver (first in \"resolvers\"), or from the first resolver that returned records when the primary returned none. Read \"records_source\" for which resolver these came from, and \"resolver_results\" for the full per-resolver picture. This is also the reference set the per-resolver answers are reported against: a resolver that returned exactly these values for a type names it in \"records_same_as_domain\" rather than repeating them."

Previous value: -"Records returned by this resolver, keyed by type."New value: +"Records returned by this resolver, keyed by type — carrying only the types whose values differ from the domain-level \"records\" set. A type this resolver answered identically is named in \"records_same_as_domain\" instead of repeated here. A requested type in neither place returned nothing from this resolver; \"status_by_type\" says why."

Added value: +{
+  "description": "Record types this resolver answered with exactly the domain-level \"records\" values, omitted from \"records\" above rather than duplicated. Read their values from the domain-level set. Resolvers agreeing is the common case, so this list is usually where most of the answer is.",
+  "items": {
+    "description": "A record type answered exactly as the domain-level set.",
+    "type": "string"
+  },
+  "type": "array"
+}

Previous value: -[
-  "resolver",
-  "latency_ms",
-  "records",
-  "status",
-  "status_by_type",
-  "error"
-]New value: +[
+  "resolver",
+  "latency_ms",
+  "records",
+  "records_same_as_domain",
+  "status",
+  "status_by_type",
+  "error"
+]

Previous value: -"Overall error message if the domain could not be queried at all."New value: +"Set only when the domain could not be queried at all — every resolver failed and none returned records. Each failing resolver is named with its own outcome (\"8.8.8.8: SERVFAIL on A; 1.1.1.1: NXDOMAIN on A\") so a split result stays visible. Null when at least one resolver answered; per-resolver failures are still in \"resolver_results\" and \"flags\"."

Previous value: -"Human-readable observations: \"propagation mismatch on A records\", \"no MX records found\", \"CNAME detected — further records resolve via the CNAME target\", etc."New value: +"Human-readable observations that need attention: \"NXDOMAIN from 8.8.8.8, 1.1.1.1 on A, MX — the domain does not exist …\", \"Partial resolution on A records — 9.9.9.9 (nodata) returned nothing while 8.8.8.8 answered\", \"No MX records found\", \"CNAME detected — further records resolve via the CNAME target\". A value_variation disagreement is not flagged here — it is reported in \"propagation_discrepancies\" because it is normal for geo-steered domains."

Previous value: -"Record types where resolvers returned different values. Empty when all resolvers agree."New value: +"Record types where resolvers returned different answers, each labelled by \"kind\". Empty when all resolvers agree."

Previous value: -"A record type where resolvers returned different values."New value: +"A record type where resolvers returned different answers."

Added value: +{
+  "description": "What the disagreement is. \"partial_resolution\" = at least one resolver returned records and at least one returned nothing; this is the signal worth investigating (in-flight propagation, a broken resolver, or a partial delegation) — read \"status_by_resolver\" for why each empty resolver was empty. \"value_variation\" = every resolver answered but with different values; this is the expected steady state for anycast and geo-steered domains such as CDN-fronted hostnames, and is also consistent with an in-flight DNS change. Neither value asserts a cause on its own.",
+  "enum": [
+    "value_variation",
+    "partial_resolution"
+  ],
+  "type": "string"
+}

Previous value: -"The DNS record type with differing values."New value: +"The DNS record type resolvers disagreed on."

Previous value: -"False when resolvers returned different values."New value: +"Always false — an entry only exists when resolvers disagreed."

Added value: +{
+  "additionalProperties": {
+    "enum": [
+      "ok",
+      "nodata",
+      "nxdomain",
+      "servfail",
+      "refused",
+      "timeout",
+      "error"
+    ],
+    "type": "string"
+  },
+  "description": "Outcome for this record type per resolver IP address — explains an empty entry in \"values_by_resolver\" as nodata, nxdomain, servfail, timeout, refused, or error.",
+  "propertyNames": {
+    "type": "string"
+  },
+  "type": "object"
+}

Previous value: -"Values reported per resolver IP address."New value: +"Values reported per resolver IP address. An empty array means that resolver returned no records of this type."

Previous value: -[
-  "record_type",
-  "resolvers_agree",
-  "values_by_resolver"
-]New value: +[
+  "record_type",
+  "resolvers_agree",
+  "kind",
+  "values_by_resolver",
+  "status_by_resolver"
+]

Previous value: -"Resolved records from the primary resolver (first in list). Keyed by record type (A, AAAA, CNAME, MX, TXT, NS)."New value: +"Resolved records from a single resolver, keyed by record type (A, AAAA, CNAME, MX, TXT, NS). Taken from the primary resolver (first in \"resolvers\"), or from the first resolver that returned records when the primary returned none. Read \"records_source\" for which resolver these came from, and \"resolver_results\" for the full per-resolver picture."

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "description": "Resolver IP whose answers populated \"records\", or null when no resolver was queried."
+}

Previous value: -"Error message if this resolver failed, or null on success."New value: +"Failure summary for this resolver in the form \"SERVFAIL on A, MX\", or null when every requested type either resolved or returned nodata. Nodata is never reported as an error — it is a valid DNS answer."

Added value: +{
+  "description": "Headline outcome for this resolver: \"ok\" when any requested record type resolved, otherwise the most actionable failure across the requested types (servfail, timeout, refused, error, nxdomain, nodata — in that order). Read \"status_by_type\" for the per-record-type detail.",
+  "enum": [
+    "ok",
+    "nodata",
+    "nxdomain",
+    "servfail",
+    "refused",
+    "timeout",
+    "error"
+  ],
+  "type": "string"
+}

Added value: +{
+  "additionalProperties": {
+    "enum": [
+      "ok",
+      "nodata",
+      "nxdomain",
+      "servfail",
+      "refused",
+      "timeout",
+      "error"
+    ],
+    "type": "string"
+  },
+  "description": "Outcome for each requested record type, keyed by type. \"ok\" = records returned; \"nodata\" = the domain exists but has no record of this type; \"nxdomain\" = the domain does not exist (check for a typo, an expired registration, or a missing delegation); \"servfail\" = the resolver could not complete the query, commonly a DNSSEC validation failure; \"refused\" = the resolver declined; \"timeout\" = no answer within timeout_ms; \"error\" = any other failure, described in \"error\".",
+  "propertyNames": {
+    "type": "string"
+  },
+  "type": "object"
+}

Previous value: -[
-  "resolver",
-  "latency_ms",
-  "records",
-  "error"
-]New value: +[
+  "resolver",
+  "latency_ms",
+  "records",
+  "status",
+  "status_by_type",
+  "error"
+]

Previous value: -[
-  "domain",
-  "records",
-  "resolver_results",
-  "propagation_discrepancies",
-  "flags",
-  "error"
-]New value: +[
+  "domain",
+  "records",
+  "records_source",
+  "resolver_results",
+  "propagation_discrepancies",
+  "flags",
+  "error"
+]

Previous value: -"Resolver IP addresses to query. Defaults to Google (8.8.8.8), Cloudflare (1.1.1.1), and Quad9 (9.9.9.9). Add custom resolvers to check internal DNS or test resolver-specific behavior."New value: +"Resolver IP addresses to query. Defaults to Google (8.8.8.8), Cloudflare (1.1.1.1), and Quad9 (9.9.9.9). Add custom resolvers to test resolver-specific behavior. Each must be an IP literal, not a hostname; resolvers in private, loopback, or cloud-metadata ranges are rejected unless DEVOPS_STATUS_ALLOW_PRIVATE_TARGETS=true."

Previous value: -"A resolver IP address (e.g., \"8.8.8.8\")."New value: +"A resolver IP literal — IPv4 (\"8.8.8.8\"), IPv6 (\"2001:4860:4860::8888\"), or either with a port (\"1.1.1.1:53\", \"[2001:4860:4860::8888]:53\"). A hostname is rejected."

Previous value: -"Query timeout per domain+resolver combination in milliseconds."New value: +"Query timeout per domain+resolver combination in milliseconds. Defaults to the DEVOPS_STATUS_DNS_TIMEOUT_MS env var (3000 when unset)."