CoreDNS Plugin: Mail spoofing protection records

**Is your feature request related to a problem? Please describe.**
To combat spam mail servers rely on certain dns record to filter incoming emails. These are SPF, DKIM, and DMARC. If the domain is not used to send mail it is a good practice to set these to highest restriction values so in case of compromise of the apps hosted under DnsPolicy the outgoing spam would be rejected.

Of course users could actually want to have proper mail servers hosted so this should be opt-out. Preferably by just creating DNSRecord CR with the corresponding domain name that would override the strict defaults.

Another approach is to let user decide if they want this protection, so a way of documentation of these best practices would be also sufficient.

**Describe the solution you'd like**

Set these by default in the zone:
- SPF record: no senders allowed
- DKIM record: wildcard selector, empty public key
- DMARC policy: reject all unauthenticated mail
```
@ IN TXT "v=spf1 -all"
*._domainkey IN TXT "v=DKIM1; p="
_dmarc IN TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s"
```

Similar to how the coredns plugin adds the SOA records.

OR
create documentation describing this topic recommending users to create respective DNSRecords themselves.

**Additional context**
https://www.cloudflare.com/learning/dns/dns-records/protect-domains-without-email/
https://www.gov.uk/guidance/protect-domains-that-dont-send-email

Start with the CoreDNS plugin behavior that adds SOA records and trace how DNSRecord resources are processed. Clarify with maintainers whether the scope is default SPF, DKIM, and DMARC records with an override, or documentation only; done means the chosen behavior and opt-out or setup guidance are covered.

Written by the indexing model from the issue text.