One searchable DNS console for every DigitalOcean domain

Build me a DNS console app for my whole DigitalOcean account. The DigitalOcean control panel scopes DNS management to one domain at a time, so I cannot answer "which records point at this IP" without opening every domain by hand. The whole point of this app is one cross-domain surface for records, plus a hygiene audit I can run per domain. Everything uses DigitalOcean and nothing else.

The main view is a single searchable table of every DNS record across every domain. Load it by calling List All Domains, then fanning out to List All Domain Records for each domain. Both are paginated (page and per_page, max 200), so keep requesting until links.pages.next is absent, otherwise I will silently miss records on bigger domains. Columns: domain, record name, type, value, and TTL. Give me a record type filter (A, AAAA, CNAME, MX, TXT, NS, SRV, CAA), a domain filter, and a free-text search that matches across both record names and values, so pasting an IP address returns every record pointing at it regardless of which domain it lives on. Let me sort by domain and by name, and show both the total record count and how many rows match the current filters.

I can act on records directly from the table. Inline edit on a row loads the current record with Retrieve an Existing Domain Record and saves with Update a Domain Record. An Add record button opens a form scoped to a chosen domain and writes with Create a New Domain Record, showing the fields that matter for the chosen type (name, data, TTL, and priority, port, weight, flags, or tag where the type needs them). Delete uses Delete a Domain Record behind a confirmation dialog that spells out the full record being removed; a successful delete returns 204 with no body, so treat an empty 204 as success rather than an error. After any write, refetch that domain's records so the table stays accurate.

The second view is a domain list: one row per domain from List All Domains, showing the domain name, how many records it has, and a health badge driven by the most recent audit for that domain (clean, warnings, or flagged issues, plus when it last ran). Each row has an Audit DNS button.

Audit DNS starts a background agent for that domain. The agent takes every A and AAAA record for the domain from List All Domain Records, then builds the set of addresses the account actually owns from List All Droplets (public IPv4 and IPv6 for each Droplet, along with its power status), List All Reserved IPs, and List All Load Balancers, paginating all three. It cross-references the record targets against that inventory and flags three things. First and highest severity, dangling records whose target address is not in the account inventory at all: these are the subdomain takeover risk and should lead the list. Second, records pointing at a Droplet that still exists but is powered off. Third, duplicate or conflicting records for the same hostname, such as several A records where one is expected, or an A record and a CNAME on the same name. Each finding should carry the domain, record id, hostname, type, value, a plain-English reason, and a severity.

The agent writes its findings back into the app so results persist between runs. Store each audit run with its timestamp and findings, keep previous runs, and show me the change since the last audit for that domain: new flags, flags that are now resolved, and flags that are still open. In the findings list, every flagged record links straight to the edit or delete control for that exact record in the main table, prefilled, so I can clear it without hunting for it. While an audit is running, show that status on the domain row, and refresh the badge and findings when it finishes.

Keep it safe by default: the audit only reads, and nothing in my DNS changes unless I explicitly edit, add, or confirm a delete.