Lockpick DNS fixes

Public-record findings in a Lockpick report are fixed in DNS, not in code. The report already names the change, the record, and usually the DNS host with a link to that host's own guide. This skill turns that into one careful change at a time, then confirms it with "Check again", which is free and makes no requests to the site.

Before you start

1. Get the finding from the user: the run page shows each DNS finding with its record, the DNS host Lockpick detected, and "Open 's guide". Ask them to paste the finding or its repair brief if you cannot see it.
2. Confirm the domain is theirs and that they can sign in to the DNS host. You guide, the user clicks. Never ask for DNS host passwords or API tokens.
3. Look up the current record before changing anything, so the change is a replacement you both understand:
   • dig +short TXT _dmarc.example.com, dig +short TXT example.com, dig +short CAA example.com, dig +short CNAME old.example.com
   • or the public lookup the report links, for example https://dns.google/query?name=_dmarc.example.com&rr_type=TXT

The changes

Replace example.com with the domain from the finding.

DMARC (email spoofing, no reporting)

Record: TXT at _dmarc.example.com. Move in stages and never jump straight to reject.