Resolve A / AAAA / MX / NS / TXT / CAA, plus registrar + expiry via RDAP. Catches missing SPF / DMARC / CAA, near-expiry domains, broken nameserver setups. No API key — uses public RDAP gateway.