Enables governed BIND 9 DNS operations and diagnostics through 23 MCP tools for zone validation, status checks, DNS queries, SOA comparison, and guarded write actions with auditing and budgets. It executes fixed rndc, named-checkconf, and dig commands without a shell and surfaces ambiguous write outcomes.