# description
Domain CAA records (which CAs may issue for our domain) plus per-subdomain ingress topology. Per-service hostname egress lives in perimeter.firewall — never re-introduce a `resolution_policy:` block here.

# properties.apex.description
Records on the bare domain (@). Typically managed by external concerns (Google Workspace MX/DKIM, Firebase Hosting A/AAAA, registrar TXT verifications). Listed here so they are not surprise-deleted during a `dns-apply` reconcile and so the verify path can flag drift.