\documentclass[a4paper,11pt]{article}

\usepackage[margin=2.5cm]{geometry}
\usepackage{lmodern}
\usepackage[T1]{fontenc}
\usepackage{hyperref}
\usepackage{enumitem}
\usepackage{fancyvrb}
\usepackage{multicol}
\usepackage{dnsrecord}

\hypersetup{
  colorlinks=true,
  linkcolor=blue,
  urlcolor=blue,
  pdftitle={dnsrecord -- Typeset DNS Records in LaTeX},
  pdfauthor={Vahid Shaik},
}

\title{\textbf{dnsrecord} --- Typeset DNS Records in \LaTeX\\[0.5em]
  \large Version 1.0.0\\[0.3em]
  \normalsize A comprehensive package for DNS documentation}
\author{Vahid Shaik\thanks{Homepage: \url{https://dnsrobot.net}
  --- Repository: \url{https://github.com/dnsrobot/latex-dnsrecord}}}
\date{March 9, 2026}

\begin{document}

\maketitle

\begin{abstract}
The \texttt{dnsrecord} package provides a comprehensive set of \LaTeX{} macros
and environments for typesetting DNS (Domain Name System) records, zone files,
propagation status tables, DNSSEC chain-of-trust diagrams, email authentication
summaries, health check reports, latency comparisons, and DNS provider tables.
It is designed for network engineers, system administrators, security researchers,
and computer science academics who need to include DNS data in papers, theses,
technical reports, and operational documentation.
The package supports 22 DNS record types with color-coded badges, configurable
display options, and both inline and tabular output formats.
\end{abstract}

\tableofcontents
\newpage

% ================================================================
\section{Introduction}
% ================================================================

The Domain Name System is one of the most critical components of internet
infrastructure, translating human-readable domain names to IP addresses
and providing essential services like email routing, service discovery, and
security validation. Despite its importance, there has been no standard
\LaTeX{} package for consistently typesetting DNS data in technical documents.

Authors of networking papers, system administration guides, and security
audit reports typically resort to ad-hoc \texttt{verbatim} environments,
manual table formatting, or inconsistent text markup when presenting DNS
records. This leads to:

\begin{itemize}[nosep]
  \item Inconsistent visual presentation across documents and authors
  \item Difficulty distinguishing between record types at a glance
  \item No semantic markup for DNS-specific data
  \item Time wasted on formatting instead of content
\end{itemize}

The \texttt{dnsrecord} package addresses these issues by providing:

\begin{itemize}[nosep]
  \item \textbf{22 record type commands} with color-coded badges
    (A, AAAA, CNAME, MX, NS, TXT, SOA, PTR, SRV, CAA, DNSKEY, DS,
    RRSIG, NSEC, NSEC3, TLSA, HTTPS, SVCB, SPF, DKIM, DMARC)
  \item \textbf{7 environments} for zone tables, propagation checks,
    DNSSEC chains, health reports, email auth, latency, and provider comparisons
  \item \textbf{Utility commands} for domains, IPs, TTLs, RCODEs, flags, and headers
  \item \textbf{6 package options} for customizing output appearance
\end{itemize}

% ================================================================
\section{Installation}
% ================================================================

\subsection{Quick install}

Copy \texttt{dnsrecord.sty} to the same directory as your document,
or to your local \texttt{texmf} tree:

\begin{Verbatim}[frame=single]
cp dnsrecord.sty ~/texmf/tex/latex/dnsrecord/
texhash ~/texmf
\end{Verbatim}

\subsection{Dependencies}

The package requires the following (all included in TeX Live and MiKTeX):

\begin{multicols}{3}
\begin{itemize}[nosep]
  \item \texttt{booktabs}
  \item \texttt{xcolor}
  \item \texttt{xparse}
  \item \texttt{etoolbox}
  \item \texttt{amsmath}
\end{itemize}
\end{multicols}

% ================================================================
\section{Package Options}
% ================================================================

\begin{Verbatim}[frame=single]
\usepackage[color,monospace,ttl]{dnsrecord}  % defaults
\end{Verbatim}

\begin{description}[style=nextline,leftmargin=3cm]
  \item[\texttt{color} / \texttt{nocolor}]
    Enable or disable color-coded record type badges.
    Default: \texttt{color}. Use \texttt{nocolor} for black-and-white printing.
  \item[\texttt{monospace} / \texttt{nomonospace}]
    Render DNS names, values, and IPs in monospace (\texttt{typewriter}) font.
    Default: \texttt{monospace}.
  \item[\texttt{ttl} / \texttt{nottl}]
    Show or hide TTL (Time To Live) values in records and tables.
    Default: \texttt{ttl}.
  \item[\texttt{class} / \texttt{noclass}]
    Show or hide DNS class (IN) in records and zone tables.
    Default: \texttt{noclass}.
  \item[\texttt{compact}]
    Use compact table layout. Default: off.
  \item[\texttt{boxed}]
    Render inline records in bordered boxes. Default: off.
\end{description}

% ================================================================
\section{Inline Record Commands}
% ================================================================

\subsection{Generic command}

The base command for any DNS record type:

\begin{Verbatim}[frame=single]
\dnsrecord{type}{name}{value}[ttl]
\end{Verbatim}

\noindent The \texttt{ttl} parameter is optional and controlled by the
\texttt{ttl}/\texttt{nottl} package option.

\medskip
\noindent Example:
\begin{Verbatim}[frame=single]
\dnsrecord{A}{example.com}{93.184.216.34}[300]
\end{Verbatim}
\noindent Result: \dnsrecord{A}{example.com}{93.184.216.34}[300]

\subsection{Standard record types}

\noindent\textbf{Address records:}

\medskip
\noindent\dnsA{example.com}{93.184.216.34}[300]

\medskip
\noindent\dnsAAAA{example.com}{2606:2800:220:1::1946}[300]

\bigskip
\noindent\textbf{Name resolution:}

\medskip
\noindent\dnsCNAME{www.example.com}{example.com}[3600]

\medskip
\noindent\dnsNS{example.com}{ns1.example.com}[86400]

\medskip
\noindent\dnsPTR{34.216.184.93.in-addr.arpa}{example.com}[3600]

\bigskip
\noindent\textbf{Mail and services:}

\medskip
\noindent\dnsMX{example.com}{10}{mail.example.com}[3600]

\medskip
\noindent\dnsSRV{\_sip.\_tcp.example.com}{10}{sip.example.com}{5060}[3600]

\bigskip
\noindent\textbf{Text and policy:}

\medskip
\noindent\dnsTXT{example.com}{v=spf1 mx -all}[300]

\medskip
\noindent\dnsCAA{example.com}{0 issue}{letsencrypt.org}[3600]

\bigskip
\noindent\textbf{Authority:}

\medskip
\noindent\dnsSOA{example.com}{ns1.example.com}{admin.example.com}[86400]

\subsection{DNSSEC record types}

\medskip
\noindent\dnsDNSKEY{example.com}{257 3 13 (base64key...)}[86400]

\medskip
\noindent\dnsDS{example.com}{12345 13 2 (digest...)}[86400]

\medskip
\noindent\dnsRRSIG{example.com}{A 13 2 300 (sig...)}[300]

\medskip
\noindent\dnsNSEC{example.com}{www.example.com A AAAA RRSIG}[300]

\medskip
\noindent\dnsNSEC3{example.com}{1 0 10 ABCDEF (hash...)}[300]

\subsection{Modern record types}

\medskip
\noindent\dnsTLSA{\_443.\_tcp.example.com}{3 1 1 (hash...)}[3600]

\medskip
\noindent\dnsHTTPS{example.com}{1 . alpn=h2,h3 ipv4hint=93.184.216.34}[300]

\medskip
\noindent\dnsSVCB{example.com}{1 . alpn=h2}[300]

\subsection{Email authentication records}

\medskip
\noindent\dnsSPF{example.com}{v=spf1 include:mail.example.com -all}[300]

\medskip
\noindent\dnsDKIM{s1.\_domainkey.example.com}{v=DKIM1; k=rsa; p=MIGf...}[3600]

\medskip
\noindent\dnsDMARC{\_dmarc.example.com}{v=DMARC1; p=reject; rua=mailto:d@example.com}[3600]

\subsection{Command reference}

\begin{Verbatim}[frame=single,fontsize=\small]
% Standard records
\dnsA{name}{ip}[ttl]
\dnsAAAA{name}{ipv6}[ttl]
\dnsCNAME{alias}{canonical}[ttl]
\dnsMX{name}{priority}{mailserver}[ttl]
\dnsNS{name}{nameserver}[ttl]
\dnsTXT{name}{text}[ttl]
\dnsSOA{name}{primary-ns}{admin-email}[ttl]
\dnsPTR{reverse-ip}{hostname}[ttl]
\dnsSRV{name}{priority}{target}{port}[ttl]
\dnsCAA{name}{flags-tag}{value}[ttl]

% DNSSEC records
\dnsDNSKEY{name}{flags-proto-algo-key}[ttl]
\dnsDS{name}{keytag-algo-digest-type-digest}[ttl]
\dnsRRSIG{name}{type-algo-labels-ttl-sig}[ttl]
\dnsNSEC{name}{next-domain-types}[ttl]
\dnsNSEC3{name}{algo-flags-iter-salt-hash}[ttl]

% Modern records
\dnsTLSA{name}{usage-selector-matching-data}[ttl]
\dnsHTTPS{name}{priority-target-params}[ttl]
\dnsSVCB{name}{priority-target-params}[ttl]

% Email authentication
\dnsSPF{name}{policy}[ttl]
\dnsDKIM{selector._domainkey.name}{policy}[ttl]
\dnsDMARC{_dmarc.name}{policy}[ttl]
\end{Verbatim}

% ================================================================
\section{Zone File Tables}
% ================================================================

The \texttt{dnszone} environment creates a formatted table for an entire
DNS zone, automatically counting records.

\begin{Verbatim}[frame=single]
\begin{dnszone}{example.com}
  \dnsentry{A}{@}{93.184.216.34}[300]
  \dnsentry{AAAA}{@}{2606:2800:220:1::1946}[300]
  \dnsentry{CNAME}{www}{example.com}[3600]
  \dnsentry{MX}{@}{mail.example.com (pri 10)}[3600]
  \dnsentry{NS}{@}{ns1.example.com}[86400]
  \dnsentry{NS}{@}{ns2.example.com}[86400]
  \dnsentry{TXT}{@}{v=spf1 mx -all}[300]
  \dnsentry{CAA}{@}{0 issue letsencrypt.org}[3600]
\end{dnszone}
\end{Verbatim}

\bigskip
\begin{dnszone}{example.com}
  \dnsentry{A}{@}{93.184.216.34}[300]
  \dnsentry{AAAA}{@}{2606:2800:220:1::1946}[300]
  \dnsentry{CNAME}{www}{example.com}[3600]
  \dnsentry{MX}{@}{mail.example.com (pri 10)}[3600]
  \dnsentry{NS}{@}{ns1.example.com}[86400]
  \dnsentry{NS}{@}{ns2.example.com}[86400]
  \dnsentry{TXT}{@}{v=spf1 mx -all}[300]
  \dnsentry{CAA}{@}{0 issue letsencrypt.org}[3600]
\end{dnszone}

\bigskip
A more complex example with DNSSEC records:

\bigskip
\begin{dnszone}{secure.example.com}
  \dnsentry{A}{@}{198.51.100.1}[300]
  \dnsentry{AAAA}{@}{2001:db8::1}[300]
  \dnsentry{NS}{@}{ns1.secure.example.com}[86400]
  \dnsentry{NS}{@}{ns2.secure.example.com}[86400]
  \dnsentry{DNSKEY}{@}{257 3 13 (KSK base64...)}[86400]
  \dnsentry{DNSKEY}{@}{256 3 13 (ZSK base64...)}[86400]
  \dnsentry{DS}{@}{12345 13 2 (digest...)}[86400]
  \dnsentry{RRSIG}{@}{A 13 3 300 (signature...)}[300]
  \dnsentry{NSEC}{@}{www.secure.example.com A AAAA NS}[300]
\end{dnszone}

% ================================================================
\section{Propagation Status Tables}
% ================================================================

The \texttt{dnspropagation} environment displays DNS record propagation
across multiple global resolver locations. This is useful for documenting
DNS migration events, TTL behavior analysis, or troubleshooting reports.

\begin{Verbatim}[frame=single]
\begin{dnspropagation}{example.com}{A}
  \dnsserver{Google}{8.8.8.8}{93.184.216.34}{5ms}{propagated}
  \dnsserver{Cloudflare}{1.1.1.1}{93.184.216.34}{3ms}{propagated}
  \dnsserver{Quad9}{9.9.9.9}{93.184.216.34}{8ms}{propagated}
  \dnsserver{OpenDNS}{208.67.222.222}{93.184.216.34}{12ms}{propagated}
  \dnsserver{ISP Germany}{194.25.0.60}{93.184.216.33}{45ms}{pending}
  \dnsserver{ISP France}{80.10.246.2}{---}{---}{failed}
  \dnsserver{ISP Japan}{210.171.224.1}{---}{120ms}{timeout}
\end{dnspropagation}
\end{Verbatim}

\bigskip
\begin{dnspropagation}{example.com}{A}
  \dnsserver{Google}{8.8.8.8}{93.184.216.34}{5ms}{propagated}
  \dnsserver{Cloudflare}{1.1.1.1}{93.184.216.34}{3ms}{propagated}
  \dnsserver{Quad9}{9.9.9.9}{93.184.216.34}{8ms}{propagated}
  \dnsserver{OpenDNS}{208.67.222.222}{93.184.216.34}{12ms}{propagated}
  \dnsserver{ISP Germany}{194.25.0.60}{93.184.216.33}{45ms}{pending}
  \dnsserver{ISP France}{80.10.246.2}{---}{---}{failed}
  \dnsserver{ISP Japan}{210.171.224.1}{---}{120ms}{timeout}
\end{dnspropagation}

\bigskip
The status indicators use color-coded bullets:
\dnsstatus{propagated}, \dnsstatus{pending}, \dnsstatus{failed}, \dnsstatus{timeout}.

% ================================================================
\section{DNSSEC Chain of Trust}
% ================================================================

The \texttt{dnssecchain} environment visualizes the DNSSEC delegation
chain from root to target domain:

\begin{Verbatim}[frame=single]
\begin{dnssecchain}{example.com}
  \dnssecentry{. (root)}{DNSKEY}{20326}{RSASHA256}
  \dnssecentry{. (root)}{DS}{20326}{RSASHA256}
  \dnssecentry{com.}{DNSKEY}{30909}{ECDSAP256SHA256}
  \dnssecentry{com.}{DS}{30909}{ECDSAP256SHA256}
  \dnssecentry{example.com.}{DNSKEY}{12345}{ECDSAP256SHA256}
  \dnssecentry{example.com.}{RRSIG}{12345}{ECDSAP256SHA256}
\end{dnssecchain}
\end{Verbatim}

\bigskip
\begin{dnssecchain}{example.com}
  \dnssecentry{. (root)}{DNSKEY}{20326}{RSASHA256}
  \dnssecentry{. (root)}{DS}{20326}{RSASHA256}
  \dnssecentry{com.}{DNSKEY}{30909}{ECDSAP256SHA256}
  \dnssecentry{com.}{DS}{30909}{ECDSAP256SHA256}
  \dnssecentry{example.com.}{DNSKEY}{12345}{ECDSAP256SHA256}
  \dnssecentry{example.com.}{RRSIG}{12345}{ECDSAP256SHA256}
\end{dnssecchain}

\bigskip
DNSSEC validation status indicators:

\medskip
\noindent\dnssec{valid} \qquad \dnssec{invalid} \qquad \dnssec{unsigned} \qquad \dnssec{insecure}

% ================================================================
\section{DNS Health Check Reports}
% ================================================================

The \texttt{dnshealthcheck} environment creates a diagnostic report
format commonly used in DNS audits:

\begin{Verbatim}[frame=single]
\begin{dnshealthcheck}{example.com}
  \dnshealthitem{healthy}{All nameservers responding}
  \dnshealthitem{healthy}{SOA serial numbers consistent}
  \dnshealthitem{healthy}{MX records resolve to valid IPs}
  \dnshealthitem{warning}{TTL for A record is below 300s}
  \dnshealthitem{warning}{No IPv6 (AAAA) record found}
  \dnshealthitem{critical}{DNSSEC signatures expired}
  \dnshealthitem{critical}{Open resolver detected on ns2}
  \dnshealthitem{info}{Domain registered until 2028-01-15}
\end{dnshealthcheck}
\end{Verbatim}

\begin{dnshealthcheck}{example.com}
  \dnshealthitem{healthy}{All nameservers responding}
  \dnshealthitem{healthy}{SOA serial numbers consistent across all NS}
  \dnshealthitem{healthy}{MX records resolve to valid IP addresses}
  \dnshealthitem{warning}{TTL for A record is below recommended 300s minimum}
  \dnshealthitem{warning}{No IPv6 (AAAA) record found for root domain}
  \dnshealthitem{critical}{DNSSEC RRSIG signatures have expired}
  \dnshealthitem{critical}{Open resolver detected on ns2.example.com}
  \dnshealthitem{info}{Domain registration expires 2028-01-15}
\end{dnshealthcheck}

% ================================================================
\section{Email Authentication Summary}
% ================================================================

The \texttt{dnsemailauth} environment displays SPF, DKIM, and DMARC
configuration status for a domain:

\begin{Verbatim}[frame=single]
\begin{dnsemailauth}{example.com}
  \dnsemailentry{SPF}{v=spf1 mx -all}{Strict}{propagated}
  \dnsemailentry{DKIM}{v=DKIM1; k=rsa; p=MIGf...}{2048-bit RSA}{propagated}
  \dnsemailentry{DMARC}{v=DMARC1; p=reject}{Reject}{propagated}
  \dnsemailentry{MX}{mail.example.com (pri 10)}{Primary}{propagated}
  \dnsemailentry{TLSA}{3 1 1 (cert hash...)}{DANE}{pending}
\end{dnsemailauth}
\end{Verbatim}

\bigskip
\begin{dnsemailauth}{example.com}
  \dnsemailentry{SPF}{v=spf1 mx -all}{Strict}{propagated}
  \dnsemailentry{DKIM}{v=DKIM1; k=rsa; p=MIGf...}{2048-bit RSA}{propagated}
  \dnsemailentry{DMARC}{v=DMARC1; p=reject}{Reject}{propagated}
  \dnsemailentry{MX}{mail.example.com (pri 10)}{Primary}{propagated}
  \dnsemailentry{TLSA}{3 1 1 (cert hash...)}{DANE}{pending}
\end{dnsemailauth}

% ================================================================
\section{DNS Latency Comparison}
% ================================================================

The \texttt{dnslatency} environment compares response times across
DNS resolvers:

\begin{Verbatim}[frame=single]
\begin{dnslatency}{example.com}
  \dnslatencyentry{Cloudflare}{1.1.1.1}{2}{4}{8}
  \dnslatencyentry{Google}{8.8.8.8}{4}{7}{15}
  \dnslatencyentry{Quad9}{9.9.9.9}{5}{9}{18}
  \dnslatencyentry{OpenDNS}{208.67.222.222}{8}{14}{25}
  \dnslatencyentry{ISP Default}{192.168.1.1}{12}{35}{120}
\end{dnslatency}
\end{Verbatim}

\bigskip
\begin{dnslatency}{example.com}
  \dnslatencyentry{Cloudflare}{1.1.1.1}{2}{4}{8}
  \dnslatencyentry{Google}{8.8.8.8}{4}{7}{15}
  \dnslatencyentry{Quad9}{9.9.9.9}{5}{9}{18}
  \dnslatencyentry{OpenDNS}{208.67.222.222}{8}{14}{25}
  \dnslatencyentry{ISP Default}{192.168.1.1}{12}{35}{120}
\end{dnslatency}

% ================================================================
\section{DNS Provider Comparison}
% ================================================================

\begin{Verbatim}[frame=single]
\begin{dnsproviders}
  \dnsprovider{Cloudflare}{1.1.1.1}{1.0.0.1}{Yes}{DoH + DoT}
  \dnsprovider{Google}{8.8.8.8}{8.8.4.4}{Yes}{DoH + DoT}
  \dnsprovider{Quad9}{9.9.9.9}{149.112.112.112}{Yes}{DoH + DoT}
  \dnsprovider{OpenDNS}{208.67.222.222}{208.67.220.220}{No}{DoH}
  \dnsprovider{AdGuard}{94.140.14.14}{94.140.15.15}{Yes}{DoH + DoT}
\end{dnsproviders}
\end{Verbatim}

\bigskip
\begin{dnsproviders}
  \dnsprovider{Cloudflare}{1.1.1.1}{1.0.0.1}{Yes}{DoH + DoT}
  \dnsprovider{Google}{8.8.8.8}{8.8.4.4}{Yes}{DoH + DoT}
  \dnsprovider{Quad9}{9.9.9.9}{149.112.112.112}{Yes}{DoH + DoT}
  \dnsprovider{OpenDNS}{208.67.222.222}{208.67.220.220}{No}{DoH}
  \dnsprovider{AdGuard}{94.140.14.14}{94.140.15.15}{Yes}{DoH + DoT}
\end{dnsproviders}

% ================================================================
\section{TTL Visualization}
% ================================================================

The \verb|\dnsttlbar| command creates a simple horizontal bar
visualization for comparing TTL values:

\begin{Verbatim}[frame=single]
\dnsttlbar{A record}{300}{86400}
\dnsttlbar{MX record}{3600}{86400}
\dnsttlbar{NS record}{86400}{86400}
\end{Verbatim}

\bigskip
\noindent\dnsttlbar{A record}{300}{86400}

\medskip
\noindent\dnsttlbar{MX record}{3600}{86400}

\medskip
\noindent\dnsttlbar{NS record}{86400}{86400}

% ================================================================
\section{Utility Commands}
% ================================================================

\subsection{Domain and IP formatting}

\begin{Verbatim}[frame=single]
\dnsdomain{example.com}      % formatted domain name
\dnsip{93.184.216.34}         % formatted IP address
\end{Verbatim}

\noindent Result: \dnsdomain{example.com} \qquad \dnsip{93.184.216.34}

\subsection{TTL with human-readable conversion}

\begin{Verbatim}[frame=single]
\dnsttl{300}     \dnsttl{3600}     \dnsttl{86400}
\end{Verbatim}

\noindent Result: \dnsttl{300} \qquad \dnsttl{3600} \qquad \dnsttl{86400}

\subsection{DNS response codes}

\begin{Verbatim}[frame=single]
\dnsrcode{NOERROR}  \dnsrcode{NXDOMAIN}  \dnsrcode{SERVFAIL}  \dnsrcode{REFUSED}
\end{Verbatim}

\noindent Result: \dnsrcode{NOERROR} \quad \dnsrcode{NXDOMAIN} \quad
\dnsrcode{SERVFAIL} \quad \dnsrcode{REFUSED}

\subsection{DNS flags}

\begin{Verbatim}[frame=single]
\dnsflag{QR} \dnsflag{AA} \dnsflag{RD} \dnsflag{RA} \dnsflag{AD} \dnsflag{CD}
\end{Verbatim}

\noindent Result: \dnsflag{QR} \dnsflag{AA} \dnsflag{RD} \dnsflag{RA}
\dnsflag{AD} \dnsflag{CD}

\subsection{DNS query/response header}

\begin{Verbatim}[frame=single]
\dnsheader{12345}{QUERY}{NOERROR}{QR RD RA AD}
\end{Verbatim}

\dnsheader{12345}{QUERY}{NOERROR}{QR RD RA AD}

% ================================================================
\section{Real-World Examples}
% ================================================================

\subsection{Example 1: Documenting a DNS migration}

When migrating \dnsdomain{company.com} from Provider A to Provider B,
the following propagation results were observed 30 minutes after the
NS record change (\dnsttl{3600} TTL):

\bigskip
\begin{dnspropagation}{company.com}{NS}
  \dnsserver{Google}{8.8.8.8}{ns1.providerb.com}{5ms}{propagated}
  \dnsserver{Cloudflare}{1.1.1.1}{ns1.providerb.com}{3ms}{propagated}
  \dnsserver{Quad9}{9.9.9.9}{ns1.providera.com}{8ms}{pending}
  \dnsserver{ISP Germany}{194.25.0.60}{ns1.providera.com}{45ms}{pending}
  \dnsserver{ISP Brazil}{200.221.11.101}{ns1.providera.com}{180ms}{pending}
\end{dnspropagation}

\subsection{Example 2: Security audit report}

DNS security assessment for \dnsdomain{bank.example.com}:

\begin{dnshealthcheck}{bank.example.com}
  \dnshealthitem{healthy}{DNSSEC fully deployed with ECDSAP256SHA256}
  \dnshealthitem{healthy}{CAA record restricts issuance to approved CAs}
  \dnshealthitem{healthy}{SPF, DKIM, and DMARC all configured with strict policies}
  \dnshealthitem{healthy}{DANE/TLSA record published for SMTP}
  \dnshealthitem{warning}{SOA refresh interval (3600s) below recommended 7200s}
  \dnshealthitem{critical}{Zone transfer (AXFR) permitted from any source}
  \dnshealthitem{info}{4 nameservers across 2 autonomous systems}
\end{dnshealthcheck}

\subsection{Example 3: Email deliverability investigation}

Email authentication configuration for \dnsdomain{newsletter.example.com}:

\bigskip
\begin{dnsemailauth}{newsletter.example.com}
  \dnsemailentry{SPF}{v=spf1 include:sendgrid.net -all}{Strict (-all)}{propagated}
  \dnsemailentry{DKIM}{v=DKIM1; k=rsa; p=MIGf...}{2048-bit RSA}{propagated}
  \dnsemailentry{DMARC}{v=DMARC1; p=quarantine; pct=100}{Quarantine}{propagated}
  \dnsemailentry{MX}{mx.sendgrid.net (pri 10)}{SendGrid}{propagated}
  \dnsemailentry{PTR}{mail.newsletter.example.com}{Reverse DNS}{failed}
\end{dnsemailauth}

\medskip
\noindent The missing PTR record (\dnsrcode{NXDOMAIN}) for the sending IP
is likely causing deliverability issues with strict mail servers.

% ================================================================
\section{Compatibility}
% ================================================================

The \texttt{dnsrecord} package has been tested with:

\begin{itemize}[nosep]
  \item \textbf{TeX Live} 2022--2026
  \item \textbf{MiKTeX} 22.1+
  \item \textbf{Overleaf} (online)
  \item \texttt{pdflatex}, \texttt{xelatex}, and \texttt{lualatex} engines
  \item \texttt{article}, \texttt{report}, \texttt{book}, and \texttt{beamer} classes
\end{itemize}

% ================================================================
\section{Known Limitations}
% ================================================================

\begin{itemize}[nosep]
  \item Long TXT record values may overflow table columns; consider using
    abbreviated values or the \texttt{compact} option
  \item The TTL bar visualization (\verb|\dnsttlbar|) uses fixed-width
    rendering and may not scale well for very large TTL differences
  \item Color-coded badges require a PDF-capable output driver
\end{itemize}

% ================================================================
\section{Changelog}
% ================================================================

\begin{description}[nosep]
  \item[v1.0.0 (2026-03-09)] Initial release. 22 record types,
    7 environments, utility commands.
\end{description}

% ================================================================
\section{License}
% ================================================================

This work is released under the \LaTeX{} Project Public License v1.3c
or later. The full text is available at:\\
\url{https://www.latex-project.org/lppl.txt}

% ================================================================
\section{Links and Contact}
% ================================================================

\begin{description}[nosep,leftmargin=3cm]
  \item[Homepage] \url{https://dnsrobot.net}
  \item[Repository] \url{https://github.com/dnsrobot/latex-dnsrecord}
  \item[Bug reports] \url{https://github.com/dnsrobot/latex-dnsrecord/issues}
  \item[CTAN] \url{https://ctan.org/pkg/dnsrecord}
  \item[Author] Vahid Shaik --- \url{https://dnsrobot.net}
\end{description}

\end{document}