Add checks deep-dive section with dangling-records case study

Introduce a new #checks section presenting domain, zone and service
checkers in three columns linking to the documentation, plus a
dangling-records case study spotlight. Rework discover copy toward
peace-of-mind framing and adjust section backgrounds and CTA layout.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

i18n/en.yaml

@@ -92,7 +92,71 @@
 - id: discover-2-tag
   translation: "Monitor"
 - id: discover-3-tag
-  translation: "Optional"
+  translation: "Relax"
+
+- id: checks-eyebrow
+  translation: "Monitoring"
+- id: checks-title
+  translation: "Deep checks on everything your domain exposes"
+- id: checks-lead
+  translation: "The moment a domain joins happyDomain, our checkers start inspecting it from the outside, exactly as the rest of the world sees it. From the registration down to each live service, every layer is covered."
+- id: checks-domain-tag
+  translation: "Domain"
+- id: checks-domain-title
+  translation: "Your registration"
+- id: checks-domain-text
+  translation: "Expiration date, transfer lock, registrar status: the administrative side of your domain, watched continuously."
+- id: checks-zone-tag
+  translation: "Zone"
+- id: checks-zone-title
+  translation: "Your DNS zone"
+- id: checks-zone-text
+  translation: "DNSSEC validity, delegation consistency, server response: the technical foundation, verified end to end."
+- id: checks-services-tag
+  translation: "Services"
+- id: checks-services-title
+  translation: "Your live services"
+- id: checks-services-text
+  translation: "Websites, certificates, mail: every service your domain points to, probed like a real visitor would."
+- id: checks-item-expiration
+  translation: "Expiration"
+- id: checks-item-expiration-detail
+  translation: "in 23 days"
+- id: checks-item-transferlock
+  translation: "Transfer lock"
+- id: checks-item-registration
+  translation: "Registration status"
+- id: checks-item-dnssec
+  translation: "DNSSEC chain"
+- id: checks-item-delegation
+  translation: "Delegation"
+- id: checks-item-responsetime
+  translation: "Response time"
+- id: checks-item-tls
+  translation: "TLS certificate"
+- id: checks-item-http
+  translation: "HTTP availability"
+- id: checks-item-ping
+  translation: "Ping"
+- id: checks-dangling-tag
+  translation: "Case study"
+- id: checks-dangling-title
+  translation: "Dangling records: the takeover nobody sees coming"
+- id: checks-dangling-text
+  translation: "When a CNAME, MX, NS or SRV record keeps pointing at a resource you no longer control (a decommissioned SaaS, an expired domain, a mistyped name server), anyone can claim that target and publish content, intercept mail or obtain valid certificates under your name."
+- id: checks-dangling-text2
+  translation: |
+    It is not a theoretical risk. <a href="https://shhaos.github.io/papers/ccs16-dares.pdf" target="_blank">The reference study on the topic</a>, <a href="https://youtube.com/watch?v=2OQ5yysJPlI" target="_blank">presented at ACM CCS 2016</a>, found 467 exploitable dangling records across 277 of the Alexa top 10,000 domains and 52 .edu zones. Since then, <a href="https://arstechnica.com/security/2026/04/why-are-top-university-websites-serving-porn-it-comes-down-to-shoddy-housekeeping/" target="_blank">top universities have been caught serving porn through forgotten CNAMEs (April 2026)</a>, and <a href="https://krebsonsecurity.com/2025/01/mastercard-dns-error-went-unnoticed-for-years/" target="_blank">a typo in one of MasterCard's name servers went unnoticed for nearly five years (January 2025)</a>. happyDomain's dangling-records checker walks every pointer in your zone, resolves its target and verifies its registration, so these forgotten records surface before someone else finds them.
+- id: checks-dangling-link
+  translation: "Read about the dangling-records checker"
+- id: checks-dangling-caption
+  translation: "happyDomain's dangling-records check in action: a forgotten CNAME flagged before anyone can claim it."
+- id: checks-footer
+  translation: "Each check reports a clear status, and you're notified the moment one of them changes."
+- id: checks-footer-link
+  translation: "Browse all checkers in the documentation"
+- id: checks-more
+  translation: "+{{ .Count }} more checkers"
 
 - id: personas-eyebrow
   translation: "For everyone"
@@ -108,11 +172,11 @@
 - id: discover-2-title
   translation: "Get instant health checks"
 - id: discover-2-text
-  translation: "From the very first minute, happyDomain runs deep checks on every domain: expiration, DNSSEC, response time and more. Nothing to configure, and you're notified the moment something changes."
+  translation: "From the very first minute, happyDomain runs deep checks on every domain: expiration, DNSSEC, certificates, response time and more. Nothing to install, nothing to configure."
 - id: discover-3-title
-  translation: "Edit when you want to"
+  translation: "Enjoy peace of mind"
 - id: discover-3-text
-  translation: "Your provider's console keeps working as before. When you're ready, guided forms, change previews and one-click rollback make every edit safer. It's there to help, never required."
+  translation: "happyDomain notifies you as soon as a problem affects your domain's configuration or any service discoverable through DNS. And when action is needed, guided editing and one-click rollback are there to help."
 
 - id: discover-assurances-title
   translation: "Our promises"