Runs the checks we can run from the authoritative side and returns a verdict for each, with the next action on anything that failed.

Read-only. Nothing here writes a record, re-signs a zone or orders a certificate, so it is safe to call on a schedule and safe to retry.

Always 200 when the hostname exists, including when every check fails - that is the case this endpoint is for, so the verdict is in the body rather than the status code. Each check carries verdict: pass, fail, warn, unknown (we could not find out, which is never the same as fine) or skipped (an earlier answer made it meaningless). summary names the first failure, because it is usually the cause of the ones after it.