dig — DNS lookups as a service (stdlib net.Resolver, 3s timeout)

LOOKUP:
  curl https://fleet-dig.0exec.com/A/example.com        # IPv4 addresses, one per line
  curl https://fleet-dig.0exec.com/AAAA/example.com     # IPv6 addresses
  curl https://fleet-dig.0exec.com/CNAME/www.example.com
  curl https://fleet-dig.0exec.com/MX/example.com       # "preference host", sorted by preference
  curl https://fleet-dig.0exec.com/NS/example.com       # authoritative name servers
  curl https://fleet-dig.0exec.com/TXT/example.com      # each TXT record on its own line
  curl https://fleet-dig.0exec.com/PTR/1.1.1.1          # reverse lookup — {name} is an IP

FORMAT:
  curl 'https://fleet-dig.0exec.com/A/example.com?json'         # JSON array instead of plain text

CHECK PROPAGATION (ask a specific public resolver):
  curl 'https://fleet-dig.0exec.com/A/example.com?server=1.1.1.1'   # Cloudflare
  curl 'https://fleet-dig.0exec.com/A/example.com?server=8.8.8.8'   # Google
  Private / loopback / link-local resolver IPs are refused (SSRF guard).

NOTES:
  * Supported types (case-insensitive): A, AAAA, CNAME, MX, NS, TXT, PTR.
  * Unknown type → 400. Implausible name → 400. No records / NXDOMAIN → 404.
  * Resolver/transport failure → 502 with a short message.
  * zsh "no matches found"? Quote any URL with a '?'  e.g. 'https://fleet-dig.0exec.com/A/x?json'.