simple org move to krz.sh

A major update — DomainDig has grown from a single-lookup tool into a full domain operations toolkit: • More checks: DNSSEC, CAA/DS/SOA/SRV records, MTA-STS and BIMI email records, RDAP ownership, domain availability, subdomain discovery, and open-port scanning. • A risk score with plain-language insights for every lookup. • Monitoring with change alerts, plus Workflows to run groups of domains as a batch. • Snapshot history with change tracking, and side-by-side domain comparison. • Audit Mode: checklists, findings, and evidence for structured reviews. • Export to CSV, JSON, Markdown, and PDF — not just plain text. • Home Screen widgets, Shortcuts, a share extension, and optional iCloud sync. • A local API for your own scripts and automation. • A complete accessibility pass: full Dynamic Type, VoiceOver, and light mode. Still local-first, with no accounts, no ads, and no tracking.

Updated screenshots, support URL, and privacy policy URL

DNS Records Added SOA, SRV, CAA, and DS record types. Each DNS section now shows a DNSSEC validation badge indicating whether the resolver authenticated the zone. A new Settings screen lets you switch between Cloudflare, Google, Quad9, or a custom DNS-over-HTTPS resolver. SSL / TLS The TLS version and negotiated cipher suite are now shown alongside the certificate details. The full certificate chain is displayed and expandable per entry. A link to crt.sh opens the domain's certificate transparency log. HSTS preload status is checked and shown inline. Email Security Added BIMI and MTA-STS record checks. DKIM selector detection now tries 10 selectors concurrently and shows which one matched. HTTP Headers Response headers now include a security grade (A–F) based on the presence of key security headers. The section header shows the HTTP status code, round-trip time, and negotiated protocol (HTTP/1.1, HTTP/2, HTTP/3). HTTP/3 availability via Alt-Svc is noted separately. Port Scanner You can now enter custom ports to probe on demand. Open ports attempt a banner grab and display the first line of any service response. Domains behind Cloudflare's proxy now show a warning explaining that only CF-proxied ports are reachable from the edge. Bug Fixes Fixed DNSSEC validation always showing as unsigned. Fixed port scan results being incorrect for Cloudflare-proxied domains.