Follow-up actionable items from post-mortem "Dangling DNS Zone — 2026-06-01"

[jonaspetersorensen]

WHY*: The dangling dns record is something that will hit us again due to how these things can "fall between the chairs" for our existing procedures and automation.

Source: 2026-06-01-dangling-dns-zone.md

Tasks

1. Migrate all DNS resources to Terraform and establish drift detection (High)
2. Evaluate Azure Defender alerts for dangling DNS records (Medium)
3. Explore and enable DNSSEC for Radix DNS zones (Medium)
4. Review and delete Azure resources not managed by Terraform; create baseline of exceptions (Medium)