resolver, watcher: a record type whose query fails keeps its previous records (closes #231)

The resolver lists in FailedTypes each record type whose query to a
nameserver got no usable reply (no reply, a code other than NOERROR or
NXDOMAIN, a referral, or a truncated reply whose TCP retry failed) and
logs it unless shutdown cut it short. A nameserver that answered no
type has failed.
The watcher saves such a type in failedTypes with the previous check's
records, leaves it out of the comparison with other nameservers on that
check, and compares it with the next answer. When the previous check
did not know its records either, it is also in unknownTypes and not
compared until it answers. A nameserver whose A, AAAA or CNAME query
failed is no answer when following a CNAME or resolving addresses.

Model: opus-5-5

internal/watcher/watcher.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"maps"
 	"slices"
 	"sort"
 	"strings"
@@ -401,8 +402,10 @@ func (w *Watcher) checkHostname(
 		return
 	}
 
+	prev, _ := w.state.GetHostnameState(hostname)
+
 	w.updateHostnameState(
-		ctx, hostname, buildHostnameState(results, time.Now().UTC()),
+		ctx, hostname, buildHostnameState(results, prev, time.Now().UTC()),
 	)
 }
 
@@ -432,8 +435,9 @@ func (w *Watcher) updateHostnameState(
 // the addresses found for all of them are saved, so nameservers that
 // disagree on the target do not change the result from check to check.
 // The addresses saved in prev, which may be nil, are kept when none of
-// the name's nameservers answered, and when a target cannot be
-// followed, as when no nameserver of a zone in its chain answers.
+// the name's nameservers answered its queries for A, AAAA and CNAME,
+// and when a target cannot be followed, as when no nameserver of a zone
+// in its chain answers.
 func (w *Watcher) resolveCNAMEAddresses(
 	ctx context.Context,
 	hostname string,
@@ -451,7 +455,10 @@ func (w *Watcher) resolveCNAMEAddresses(
 	targets := make(map[string]bool)
 
 	for _, nsState := range current.RecordsByNameserver {
-		if nsState.Status != statusOK {
+		if nsState.Status != statusOK ||
+			slices.Contains(nsState.FailedTypes, "A") ||
+			slices.Contains(nsState.FailedTypes, "AAAA") ||
+			slices.Contains(nsState.FailedTypes, "CNAME") {
 			continue
 		}
 
@@ -497,11 +504,13 @@ func (w *Watcher) resolveCNAMEAddresses(
 }
 
 // buildHostnameState saves each nameserver's response. A nameserver
-// that answered, even with NXDOMAIN or no records, is saved as ok; one
-// that timed out or failed is saved as error with the reason, and its
-// empty record set is not an answer.
+// that answered, even with NXDOMAIN or no records, is saved as ok, with
+// the record types whose query failed; one that timed out or failed is
+// saved as error with the reason, and its empty record set is not an
+// answer. prev is the hostname's state from the previous check, or nil.
 func buildHostnameState(
 	results map[string]*resolver.NameserverResponse,
+	prev *state.HostnameState,
 	now time.Time,
 ) *state.HostnameState {
 	hs := &state.HostnameState{
@@ -513,7 +522,7 @@ func buildHostnameState(
 
 	for ns, resp := range results {
 		nsState := &state.NameserverRecordState{
-			Records:     resp.Records,
+			Records:     maps.Clone(resp.Records),
 			Status:      statusOK,
 			LastChecked: now,
 		}
@@ -522,6 +531,15 @@ func buildHostnameState(
 			resp.Status == resolver.StatusError {
 			nsState.Status = statusError
 			nsState.Error = resp.Error
+		} else {
+			nsState.FailedTypes = resp.FailedTypes
+
+			var prevNS *state.NameserverRecordState
+			if prev != nil {
+				prevNS = prev.RecordsByNameserver[ns]
+			}
+
+			keepFailedTypes(nsState, prevNS)
 		}
 
 		hs.RecordsByNameserver[ns] = nsState
@@ -530,6 +548,27 @@ func buildHostnameState(
 	return hs
 }
 
+// keepFailedTypes copies into nsState, for each record type in its
+// FailedTypes, the records prevNS, the nameserver's state from the
+// previous check, holds for that type, which may be none. When prevNS
+// does not know them either, because the nameserver was new or failing
+// then or the type was in its UnknownTypes, the type goes in
+// nsState.UnknownTypes instead.
+func keepFailedTypes(nsState, prevNS *state.NameserverRecordState) {
+	for _, rtype := range nsState.FailedTypes {
+		if prevNS == nil || prevNS.Status != statusOK ||
+			slices.Contains(prevNS.UnknownTypes, rtype) {
+			nsState.UnknownTypes = append(nsState.UnknownTypes, rtype)
+
+			continue
+		}
+
+		if records, ok := prevNS.Records[rtype]; ok {
+			nsState.Records[rtype] = records
+		}
+	}
+}
+
 func (w *Watcher) detectHostnameChanges(
 	ctx context.Context,
 	hostname string,
@@ -618,7 +657,10 @@ func (w *Watcher) detectCNAMEAddressChanges(
 
 // detectRecordChanges compares each nameserver's records with those of
 // the previous check. Only answers are compared: a nameserver that
-// failed on either check has no records to compare.
+// failed on either check has no records to compare. The records kept
+// for a record type whose query failed are compared too, but not those
+// of a type in UnknownTypes on either check, which the message leaves
+// out as well.
 func (w *Watcher) detectRecordChanges(
 	ctx context.Context,
 	hostname string,
@@ -630,7 +672,11 @@ func (w *Watcher) detectRecordChanges(
 			continue
 		}
 
-		if recordsEqual(prevNS.Records, cur.Records) {
+		unknown := slices.Concat(prevNS.UnknownTypes, cur.UnknownTypes)
+		oldRecords := withoutTypes(prevNS.Records, unknown)
+		newRecords := withoutTypes(cur.Records, unknown)
+
+		if recordsEqual(oldRecords, newRecords) {
 			continue
 		}
 
@@ -638,8 +684,8 @@ func (w *Watcher) detectRecordChanges(
 			"%s\nNameserver: %s\n%s",
 			w.nameLine(hostname), ns,
 			recordDifferences(
-				"Old", prevNS.Records,
-				"New", cur.Records,
+				"Old", oldRecords,
+				"New", newRecords,
 			),
 		)
 
@@ -726,13 +772,19 @@ func (w *Watcher) detectInconsistencies(
 ) {
 	for _, pair := range newlyDisagreeingPairs(prev, current) {
 		ns1, ns2 := pair[0], pair[1]
+		state1 := current.RecordsByNameserver[ns1]
+		state2 := current.RecordsByNameserver[ns2]
+
+		// The record types left out of the comparison are left out of
+		// the message too.
+		failed := slices.Concat(state1.FailedTypes, state2.FailedTypes)
 
 		msg := fmt.Sprintf(
 			"%s\n%s",
 			w.nameLine(hostname),
 			recordDifferences(
-				ns1, current.RecordsByNameserver[ns1].Records,
-				ns2, current.RecordsByNameserver[ns2].Records,
+				ns1, withoutTypes(state1.Records, failed),
+				ns2, withoutTypes(state2.Records, failed),
 			),
 		)
 
@@ -750,7 +802,9 @@ func (w *Watcher) detectInconsistencies(
 // except pairs where both nameservers answered in prev and already
 // differed there. A nameserver missing from prev, or that failed there,
 // is paired with every nameserver it differs from. A nameserver that
-// failed in current has no records to compare and is in no pair.
+// failed in current has no records to compare and is in no pair. In
+// both checks, a record type whose query failed at either nameserver is
+// not compared.
 func newlyDisagreeingPairs(
 	prev, current *state.HostnameState,
 ) [][2]string {
@@ -767,9 +821,9 @@ func newlyDisagreeingPairs(
 
 	for i, ns1 := range nameservers {
 		for _, ns2 := range nameservers[i+1:] {
-			if recordsEqual(
-				current.RecordsByNameserver[ns1].Records,
-				current.RecordsByNameserver[ns2].Records,
+			if nameserversAgree(
+				current.RecordsByNameserver[ns1],
+				current.RecordsByNameserver[ns2],
 			) {
 				continue
 			}
@@ -779,7 +833,7 @@ func newlyDisagreeingPairs(
 
 			if ok1 && ok2 &&
 				prev1.Status == statusOK && prev2.Status == statusOK &&
-				!recordsEqual(prev1.Records, prev2.Records) {
+				!nameserversAgree(prev1, prev2) {
 				continue
 			}
 
@@ -1268,6 +1322,33 @@ func toSet(items []string) map[string]bool {
 	return set
 }
 
+// nameserversAgree reports whether two nameservers' states from the same
+// check hold the same records, leaving out the record types either lists
+// in FailedTypes: the records held for those are kept from an earlier
+// check, or not known.
+func nameserversAgree(a, b *state.NameserverRecordState) bool {
+	failed := slices.Concat(a.FailedTypes, b.FailedTypes)
+
+	return recordsEqual(
+		withoutTypes(a.Records, failed), withoutTypes(b.Records, failed),
+	)
+}
+
+// withoutTypes returns a copy of records without the record types in
+// types.
+func withoutTypes(
+	records map[string][]string,
+	types []string,
+) map[string][]string {
+	records = maps.Clone(records)
+
+	for _, rtype := range types {
+		delete(records, rtype)
+	}
+
+	return records
+}
+
 func recordsEqual(
 	a, b map[string][]string,
 ) bool {