# description
Domain CAA records (which CAs may issue for our domain) plus per-subdomain ingress topology. Per-service hostname egress lives in perimeter.firewall — never re-introduce a `resolution_policy:` block here.

# properties.apex.description
Records on the bare domain (@). Typically managed by external concerns (Google Workspace MX/DKIM, Firebase Hosting A/AAAA, registrar TXT verifications). Listed here so the network-validate checks can diff the billy-dns Cloud DNS stack (ADR-282) against the declared baseline and flag drift.