feat: add cached DNS checks

docs/deployment/configuration.md

@@ -109,6 +109,14 @@ policy if long-term storage size matters.
 | `CF_API_TOKEN` | Cloudflare API token | - | `your_cloudflare_api_token` |
 | `CF_ZONE_ID` | Cloudflare Zone ID | - | `your_cloudflare_zone_id` |
 
+### DNS Result Cache
+
+DMARC, SPF, and DKIM DNS checks are cached in the database-backed `dns_cache`
+table for 15 minutes per domain, DNS provider, and DKIM selector set. Domain DNS
+API responses include whether the result came from cache and when it was
+checked. Use `?refresh=true` on the domain DNS endpoint to bypass a fresh cache
+entry for operational rechecks.
+
 ### Advanced Configuration
 
 | Variable | Description | Default | Example |

docs/milestones.md

@@ -128,9 +128,11 @@ Status: Planned
 
 Goal: connect report findings with DNS configuration guidance.
 
-Planned:
-- DMARC/SPF/DKIM DNS checks with cached results.
+Delivered:
+- DMARC/SPF/DKIM DNS checks with database-backed cached results.
 - DKIM selector discovery from report data.
+
+Planned:
 - Per-domain DNS health summary.
 - Suggestions for moving from `p=none` to enforcement when compliance supports it.
 - Optional Cloudflare read-only integration for DNS record inspection.

docs/todo.md

@@ -168,6 +168,7 @@ Status: Complete for the delivered reporting milestone. Alert-specific dashboard
 - [x] Add alert rules for new sender source, compliance drop, DMARC failures above threshold, and missing reports
 - [x] Add daily and weekly summary notifications
 - [x] Add alert history
+- [x] Add cached DMARC/SPF/DKIM DNS checks and report-discovered DKIM selectors
 - [ ] DNS health guidance and Cloudflare read-only inspection
 - [ ] Guided setup and operator health pages
 - [ ] Forensic/RUF report support