EDNS Extensions:
- Extended DNS Errors (RFC 8914): EDE option in SERVFAIL/stale responses
- EDNS Client Subnet (RFC 7871): parse/build/forward ECS, ECS-aware cache
- DNS Cookies (RFC 7873): client/server cookie generation via HMAC-SHA256

DNSSEC Hardening:
- NSEC3 proof validation (RFC 5155): hash computation, denial proof, 150 iter cap
- Harden-referral-path: log suspicious NS hostnames in delegations

Operational Features:
- RPZ (Response Policy Zones): parser, matcher, NXDOMAIN/NODATA/passthru/drop/redirect
- DNS64 (RFC 6147): synthesize AAAA from A with configurable prefix (64:ff9b::/96)
- Per-zone ACL: zone-specific allow/deny rules with longest-suffix matching

New files: dns/ecs.go, dnssec/nsec3.go, blocklist/rpz.go, resolver/dns64.go
Config: ecs_enabled, dns_cookies, dns64_enabled/prefix, access_control.zones
Tests: 50+ new tests