Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +false

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "results"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Added value: +{
+  "additionalProperties": {},
+  "description": "Present when the call failed. Absent on success.",
+  "properties": {
+    "code": {
+      "description": "JSON-RPC error code for this failure.",
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "data": {
+      "additionalProperties": {},
+      "properties": {
+        "reason": {
+          "description": "Machine-readable failure mode. Declared by this tool: `invalid_domain`: A domain string contains a protocol prefix or invalid format. `target_blocked`: A resolver is a private, loopback, or otherwise non-public address, or is not an IP literal at all. Other values are possible when a failure originates below the handler.",
+          "examples": [
+            "invalid_domain",
+            "target_blocked"
+          ],
+          "type": "string"
+        },
+        "recovery": {
+          "additionalProperties": {},
+          "description": "Actionable next step for the caller.",
+          "properties": {
+            "hint": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "hint"
+          ],
+          "type": "object"
+        },
+        "retryable": {
+          "description": "Whether retrying may succeed.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "message": {
+      "description": "Human-readable description of what went wrong.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "code",
+    "message"
+  ],
+  "type": "object"
+}

Removed value: -[
-  "results"
-]

Previous value: -"Resolved records from a single resolver, keyed by record type (A, AAAA, CNAME, MX, TXT, NS). Taken from the primary resolver (first in \"resolvers\"), or from the first resolver that returned records when the primary returned none. Read \"records_source\" for which resolver these came from, and \"resolver_results\" for the full per-resolver picture."New value: +"Resolved records from a single resolver, keyed by record type (A, AAAA, CNAME, MX, TXT, NS). Taken from the primary resolver (first in \"resolvers\"), or from the first resolver that returned records when the primary returned none. Read \"records_source\" for which resolver these came from, and \"resolver_results\" for the full per-resolver picture. This is also the reference set the per-resolver answers are reported against: a resolver that returned exactly these values for a type names it in \"records_same_as_domain\" rather than repeating them."

Previous value: -"Records returned by this resolver, keyed by type."New value: +"Records returned by this resolver, keyed by type — carrying only the types whose values differ from the domain-level \"records\" set. A type this resolver answered identically is named in \"records_same_as_domain\" instead of repeated here. A requested type in neither place returned nothing from this resolver; \"status_by_type\" says why."

Added value: +{
+  "description": "Record types this resolver answered with exactly the domain-level \"records\" values, omitted from \"records\" above rather than duplicated. Read their values from the domain-level set. Resolvers agreeing is the common case, so this list is usually where most of the answer is.",
+  "items": {
+    "description": "A record type answered exactly as the domain-level set.",
+    "type": "string"
+  },
+  "type": "array"
+}

Previous value: -[
-  "resolver",
-  "latency_ms",
-  "records",
-  "status",
-  "status_by_type",
-  "error"
-]New value: +[
+  "resolver",
+  "latency_ms",
+  "records",
+  "records_same_as_domain",
+  "status",
+  "status_by_type",
+  "error"
+]

Previous value: -"Overall error message if the domain could not be queried at all."New value: +"Set only when the domain could not be queried at all — every resolver failed and none returned records. Each failing resolver is named with its own outcome (\"8.8.8.8: SERVFAIL on A; 1.1.1.1: NXDOMAIN on A\") so a split result stays visible. Null when at least one resolver answered; per-resolver failures are still in \"resolver_results\" and \"flags\"."

Previous value: -"Human-readable observations: \"propagation mismatch on A records\", \"no MX records found\", \"CNAME detected — further records resolve via the CNAME target\", etc."New value: +"Human-readable observations that need attention: \"NXDOMAIN from 8.8.8.8, 1.1.1.1 on A, MX — the domain does not exist …\", \"Partial resolution on A records — 9.9.9.9 (nodata) returned nothing while 8.8.8.8 answered\", \"No MX records found\", \"CNAME detected — further records resolve via the CNAME target\". A value_variation disagreement is not flagged here — it is reported in \"propagation_discrepancies\" because it is normal for geo-steered domains."

Previous value: -"Record types where resolvers returned different values. Empty when all resolvers agree."New value: +"Record types where resolvers returned different answers, each labelled by \"kind\". Empty when all resolvers agree."

Previous value: -"A record type where resolvers returned different values."New value: +"A record type where resolvers returned different answers."

Added value: +{
+  "description": "What the disagreement is. \"partial_resolution\" = at least one resolver returned records and at least one returned nothing; this is the signal worth investigating (in-flight propagation, a broken resolver, or a partial delegation) — read \"status_by_resolver\" for why each empty resolver was empty. \"value_variation\" = every resolver answered but with different values; this is the expected steady state for anycast and geo-steered domains such as CDN-fronted hostnames, and is also consistent with an in-flight DNS change. Neither value asserts a cause on its own.",
+  "enum": [
+    "value_variation",
+    "partial_resolution"
+  ],
+  "type": "string"
+}

Previous value: -"The DNS record type with differing values."New value: +"The DNS record type resolvers disagreed on."

Previous value: -"False when resolvers returned different values."New value: +"Always false — an entry only exists when resolvers disagreed."

Added value: +{
+  "additionalProperties": {
+    "enum": [
+      "ok",
+      "nodata",
+      "nxdomain",
+      "servfail",
+      "refused",
+      "timeout",
+      "error"
+    ],
+    "type": "string"
+  },
+  "description": "Outcome for this record type per resolver IP address — explains an empty entry in \"values_by_resolver\" as nodata, nxdomain, servfail, timeout, refused, or error.",
+  "propertyNames": {
+    "type": "string"
+  },
+  "type": "object"
+}

Previous value: -"Values reported per resolver IP address."New value: +"Values reported per resolver IP address. An empty array means that resolver returned no records of this type."

Previous value: -[
-  "record_type",
-  "resolvers_agree",
-  "values_by_resolver"
-]New value: +[
+  "record_type",
+  "resolvers_agree",
+  "kind",
+  "values_by_resolver",
+  "status_by_resolver"
+]

Previous value: -"Resolved records from the primary resolver (first in list). Keyed by record type (A, AAAA, CNAME, MX, TXT, NS)."New value: +"Resolved records from a single resolver, keyed by record type (A, AAAA, CNAME, MX, TXT, NS). Taken from the primary resolver (first in \"resolvers\"), or from the first resolver that returned records when the primary returned none. Read \"records_source\" for which resolver these came from, and \"resolver_results\" for the full per-resolver picture."

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "description": "Resolver IP whose answers populated \"records\", or null when no resolver was queried."
+}

Previous value: -"Error message if this resolver failed, or null on success."New value: +"Failure summary for this resolver in the form \"SERVFAIL on A, MX\", or null when every requested type either resolved or returned nodata. Nodata is never reported as an error — it is a valid DNS answer."

Added value: +{
+  "description": "Headline outcome for this resolver: \"ok\" when any requested record type resolved, otherwise the most actionable failure across the requested types (servfail, timeout, refused, error, nxdomain, nodata — in that order). Read \"status_by_type\" for the per-record-type detail.",
+  "enum": [
+    "ok",
+    "nodata",
+    "nxdomain",
+    "servfail",
+    "refused",
+    "timeout",
+    "error"
+  ],
+  "type": "string"
+}

Added value: +{
+  "additionalProperties": {
+    "enum": [
+      "ok",
+      "nodata",
+      "nxdomain",
+      "servfail",
+      "refused",
+      "timeout",
+      "error"
+    ],
+    "type": "string"
+  },
+  "description": "Outcome for each requested record type, keyed by type. \"ok\" = records returned; \"nodata\" = the domain exists but has no record of this type; \"nxdomain\" = the domain does not exist (check for a typo, an expired registration, or a missing delegation); \"servfail\" = the resolver could not complete the query, commonly a DNSSEC validation failure; \"refused\" = the resolver declined; \"timeout\" = no answer within timeout_ms; \"error\" = any other failure, described in \"error\".",
+  "propertyNames": {
+    "type": "string"
+  },
+  "type": "object"
+}

Previous value: -[
-  "resolver",
-  "latency_ms",
-  "records",
-  "error"
-]New value: +[
+  "resolver",
+  "latency_ms",
+  "records",
+  "status",
+  "status_by_type",
+  "error"
+]

Previous value: -[
-  "domain",
-  "records",
-  "resolver_results",
-  "propagation_discrepancies",
-  "flags",
-  "error"
-]New value: +[
+  "domain",
+  "records",
+  "records_source",
+  "resolver_results",
+  "propagation_discrepancies",
+  "flags",
+  "error"
+]

Previous value: -"Resolver IP addresses to query. Defaults to Google (8.8.8.8), Cloudflare (1.1.1.1), and Quad9 (9.9.9.9). Add custom resolvers to check internal DNS or test resolver-specific behavior."New value: +"Resolver IP addresses to query. Defaults to Google (8.8.8.8), Cloudflare (1.1.1.1), and Quad9 (9.9.9.9). Add custom resolvers to test resolver-specific behavior. Each must be an IP literal, not a hostname; resolvers in private, loopback, or cloud-metadata ranges are rejected unless DEVOPS_STATUS_ALLOW_PRIVATE_TARGETS=true."

Previous value: -"A resolver IP address (e.g., \"8.8.8.8\")."New value: +"A resolver IP literal — IPv4 (\"8.8.8.8\"), IPv6 (\"2001:4860:4860::8888\"), or either with a port (\"1.1.1.1:53\", \"[2001:4860:4860::8888]:53\"). A hostname is rejected."

Previous value: -"Query timeout per domain+resolver combination in milliseconds."New value: +"Query timeout per domain+resolver combination in milliseconds. Defaults to the DEVOPS_STATUS_DNS_TIMEOUT_MS env var (3000 when unset)."