CAA / DNSSEC Checker

CAA issuance policy, DNSKEY/DS at the zone, and whether public resolvers set the AD bit.