Guided DNS check: detect the tenant's DNS host and confirm published records. Read-only — runs live lookups against public DNS (no resolver dependency) and never touches verification_status; SES stays the authority for that (see POST /{domain_id}/verify). Org-scoped: returns 404 for a domain belonging to a different organization. kind='hail_mail' rows do no DNS lookups at all — the shared hail-mail domain has nothing for the tenant to publish.