Whether the record authenticated (signature, key, timestamp all check out).
OptionalauthAuthorization flag from the DNS record (a=), when present.
Whether the key was revoked via p=revoke or r= date.
Domain the record claims (d=).
Key algorithm from ka= (e.g. rsa).
Signature value encoding from sf= (e.g. base64).
Record timestamp, parsed, or null when absent/malformed.
Filename the buffer was scanned under (drives format detection).
Fatal validation error, or null when valid.
Non-fatal warnings collected during validation.
Parsed TXT-style fields of the record.
OptionalrecordZero-based index of this record within the buffer.
OptionalrecordTotal SEAL records found in the buffer.
Outcome of validating one SEAL record: validity plus the parsed key facts.