"I have published it - can you see it yet?" Resolves ONE of a protected domain's DNS records on public resolvers (8.8.8.8, then 1.1.1.1) and reports what is there right now, without waiting for our observer's next 15-minute pass.

record is one of dmarc (default), spf, tlsrpt, mtasts or bimi and selects the host that is queried: _dmarc.{domain}, {domain} (SPF lives at the apex), _smtp._tls.{domain}, _mta-sts.{domain} or default._bimi.{domain}. The host is always built from the REGISTRY row, never from anything the caller supplies, so this is not an open DNS proxy. The TXT record that counts is the one starting with the protocol's version tag (v=DMARC1, v=spf1, v=TLSRPTv1, v=STSv1, v=BIMI1); multi-string TXT answers are concatenated first.

Found: false means the resolver answered and no matching record exists yet - DNS changes take minutes to propagate, so it does not mean the record is wrong. ContainsReportingAddress says whether the found record carries the row's reporting address; it is meaningful for dmarc and tlsrpt and always false for the other records.

ADVISORY ONLY - this call stores nothing; our observer remains the single writer of every observed attribute, so the row's own dmarc.record / checkedUtc / containsReportingAddress do not change because of it. It does ASK the observer to run sooner: when record is dmarc and the found record contains the reporting address (the observation that flips pending_dns to verified), the observer is nudged and Nudged is true - poll get-protected-domain for the row to catch up in seconds rather than at the next 15-minute tick. There is no cooldown on this endpoint beyond the API quota; the only other cap is the observer's per-tenant nudge budget of 200 per day, past which a nudge is dropped by the observer, not refused here.

Requires an Enterprise subscription (ErrorCode ENTERPRISE_REQUIRED; not satisfied by Professional, and get-entitlements.isEnterpriseEntitled does not imply it for partner-managed or staff-trial tenants). Platform Admin or Super Admin and a paid plan - gated as a write although it stores nothing, because the nudge spends fleet resources.