resolver: ask a referral's nameservers that come without addresses (closes #221)

Looking up a nameserver's own address followed only the addresses a
referral gave, so a nameserver whose zone is delegated without them,
such as a.ntpns.org of pool.ntp.org, never resolved. The walk to a
name's nameservers looked addresses up only when a referral gave none,
so when it gave some it asked only those. Both now ask the nameservers
whose addresses the referral gives first and, if none of them gives a
usable reply, look up and ask the others; with no addresses given, all
are looked up, as before. Looking up all of them at once sent too many
queries to the root servers. maxLookupDepth stops lookups two deep, so
delegations that point at each other still end.

Model: opus-5-5

internal/resolver/export_test.go

@@ -48,12 +48,31 @@ func (r *Resolver) QueryEachNS(
 	return r.queryEachNS(ctx, nameservers, hostname, recordTypes())
 }
 
-// ResolveNSIPs exports resolveNSIPs for testing.
+// ResolveNSIPs exports resolveNSIPs for testing, looking each name up
+// as a lookup that no other lookup started.
 func (r *Resolver) ResolveNSIPs(
 	ctx context.Context,
 	nsNames []string,
 ) []string {
-	return r.resolveNSIPs(ctx, nsNames)
+	return r.resolveNSIPs(ctx, nsNames, 1)
+}
+
+// MaxLookupDepth exports maxLookupDepth for testing.
+const MaxLookupDepth = maxLookupDepth
+
+// QueryNameservers exports queryNameservers for testing.
+func (r *Resolver) QueryNameservers(
+	ctx context.Context,
+	given []string,
+	withoutAddresses []string,
+	zone string,
+	name string,
+	qtype uint16,
+	depth int,
+) (*dns.Msg, error) {
+	return r.queryNameservers(
+		ctx, given, withoutAddresses, zone, name, qtype, depth,
+	)
 }
 
 // RootServerList exports rootServerList for testing.