resolver: a nameserver is asked at each of its addresses in turn (closes #285)

A nameserver's queries went only to the first IPv4 address its name
resolves to, so one unreachable address made it fail whenever that
address came first in the answer. Each record type is now asked at the
addresses one at a time until one gives a usable reply, and the next
type is asked first at the address that gave it. A type that fails is
logged with the reason at each address, and a nameserver is reported as
timed out only when every query timed out. The README's DNS Resolution
Strategy says which addresses are asked.

Model: opus-5-5

internal/resolver/resolver_test.go

@@ -360,6 +360,110 @@ func TestQueryNameserver_ZoneDelegatedWithoutAddresses(t *testing.T) {
 	assert.Equal(t, resolver.StatusOK, resp.Status)
 }
 
+// TestQueryTypes_FirstAddressNeverAnswers asks a google.com nameserver
+// about google.com's A and AAAA records at a list of addresses that puts
+// 192.0.2.1, where nothing answers, before the nameserver's own. The
+// nameserver answers at its own address, so it is ok, with its records.
+// Each attempt has time for one round of tries at 192.0.2.1, two tries
+// of two seconds, and not for two, so AAAA must be asked first at the
+// address that answered A.
+func TestQueryTypes_FirstAddressNeverAnswers(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	ns := findOneNSForDomain(t, r, "google.com")
+	nsIPs := append(
+		[]string{noAnswerAddress}, liveResolveNSIPs(t, r, []string{ns}, 1)...,
+	)
+
+	var resp *resolver.NameserverResponse
+
+	livednstest.Retry(
+		t,
+		"QueryTypes("+ns+" at "+strings.Join(nsIPs, ", ")+", google.com)",
+		func(ctx context.Context) error {
+			ctx, cancel := context.WithTimeout(ctx, 6*time.Second)
+			defer cancel()
+
+			var err error
+
+			resp, err = r.QueryTypes(
+				ctx, ns, nsIPs, "google.com.",
+				[]uint16{dns.TypeA, dns.TypeAAAA},
+			)
+			if err != nil {
+				return err
+			}
+
+			if len(resp.FailedTypes) > 0 {
+				return fmt.Errorf(
+					"%w: %s gave no usable reply for %s",
+					livednstest.ErrNoAnswer, ns,
+					strings.Join(resp.FailedTypes, ", "),
+				)
+			}
+
+			return nil
+		},
+	)
+
+	assert.Equal(t, resolver.StatusOK, resp.Status)
+	assert.NotEmpty(t, resp.Records["A"])
+	assert.NotEmpty(t, resp.Records["AAAA"])
+}
+
+// TestQueryTypes_EveryAddressFails asks a google.com nameserver about
+// cloudflare.com, a zone it does not serve, at 192.0.2.1, where nothing
+// answers, and then at its own address, which refuses. The nameserver
+// has failed with the refusal, not a timeout, and the warning about the
+// type gives the reason at each address.
+func TestQueryTypes_EveryAddressFails(t *testing.T) {
+	t.Parallel()
+
+	var logs bytes.Buffer
+
+	r := resolver.NewFromLogger(slog.New(slog.NewTextHandler(&logs, nil)))
+	ns := findOneNSForDomain(t, r, "google.com")
+	nsIPs := append(
+		[]string{noAnswerAddress}, liveResolveNSIPs(t, r, []string{ns}, 1)...,
+	)
+
+	var resp *resolver.NameserverResponse
+
+	livednstest.Retry(
+		t,
+		"QueryTypes("+ns+" at "+strings.Join(nsIPs, ", ")+", cloudflare.com)",
+		func(ctx context.Context) error {
+			logs.Reset()
+
+			var err error
+
+			resp, err = r.QueryTypes(
+				ctx, ns, nsIPs, "cloudflare.com.", []uint16{dns.TypeA},
+			)
+			if err != nil {
+				return err
+			}
+
+			// A timeout or a network error at its own address is no
+			// reply at all.
+			if resp.Status == resolver.StatusTimeout ||
+				strings.HasPrefix(resp.Error, "network error") {
+				return fmt.Errorf(
+					"%w: %s: %s", livednstest.ErrNoAnswer, ns, resp.Error,
+				)
+			}
+
+			return nil
+		},
+	)
+
+	assert.Equal(t, resolver.StatusError, resp.Status)
+	assert.Equal(t, "server returned REFUSED", resp.Error)
+	assert.Contains(t, logs.String(), "@"+noAnswerAddress+": ")
+	assert.Contains(t, logs.String(), "@"+nsIPs[1]+": ")
+}
+
 func TestQueryNameserver_AAAA(t *testing.T) {
 	t.Parallel()