resolver, watcher: a domain's nameservers are only its own delegation (closes #222)

When a domain's parent zone's servers answer NXDOMAIN, LookupNS returns
ErrNXDomain. The watcher then saves the domain with no nameservers and
nxdomain set, shown on the dashboard and in /api/v1/status, asks for none
of its records and removes those saved, so its old nameservers go in one
NS Change. A domain with no delegation of its own gets an empty set and
its records are still asked at the zone it is in.
FindAuthoritativeNameservers moves to a parent name only on one of those
two answers; when the servers do not answer, it returns the error. After
an upgrade, a domain without its own delegation that was saved with its
parent zone's nameservers gets one NS Change; the README says so.

Model: opus-5-5

internal/resolver/resolver_test.go

@@ -25,6 +25,13 @@ import (
 // Test helpers
 // ----------------------------------------------------------------
 
+// nonexistentDomain is a .com domain that does not exist.
+const nonexistentDomain = "dnswatcher-test-does-not-exist.com"
+
+// noAnswerAddress is 192.0.2.1, a documentation address: nothing
+// answers there.
+const noAnswerAddress = "192.0.2.1"
+
 func newTestResolver(t *testing.T) *resolver.Resolver {
 	t.Helper()
 
@@ -88,6 +95,47 @@ func TestFindAuthoritativeNameservers_Subdomain(
 	assert.Equal(t, fromZone, fromHost)
 }
 
+// TestFindAuthoritativeNameservers_DelegatedSubdomain looks up the
+// nameservers of www.cs.cmu.edu, a name in cs.cmu.edu, a zone that
+// cmu.edu delegates to other servers. The servers of cs.cmu.edu answer
+// that the name has no delegation of its own, so it gets their names,
+// not those of the cmu.edu servers. Every referral on the way gives the
+// nameservers' addresses, so the walk sends few queries.
+func TestFindAuthoritativeNameservers_DelegatedSubdomain(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	fromHost := liveFindAuthoritative(t, r, "www.cs.cmu.edu")
+	fromZone := liveLookupNS(t, r, "cs.cmu.edu")
+	fromParent := liveLookupNS(t, r, "cmu.edu")
+
+	assert.Equal(t, fromZone, fromHost)
+	assert.NotEqual(t, fromParent, fromHost)
+}
+
+// TestFindAuthoritativeNameservers_NoAnswer starts each walk for
+// www.google.com at 192.0.2.1, a documentation address where nothing
+// answers. A walk that got no answer does not say that the name has no
+// delegation of its own, so the lookup returns that walk's error, about
+// www.google.com, and tries no parent name: trying google.com and com
+// would end in ErrNoNameservers, or in the error of a walk for one of
+// them.
+func TestFindAuthoritativeNameservers_NoAnswer(t *testing.T) {
+	t.Parallel()
+
+	r := resolver.NewWithQueryTimeout(slog.Default(), 100*time.Millisecond)
+
+	nameservers, err := r.FindAuthoritativeNameserversFrom(
+		t.Context(), "www.google.com", []string{noAnswerAddress},
+	)
+	require.Error(t, err)
+	require.NotErrorIs(t, err, resolver.ErrNoNameservers)
+	assert.Contains(t, err.Error(), "query www.google.com. @"+noAnswerAddress)
+	assert.Empty(t, nameservers)
+}
+
 func TestFindAuthoritativeNameservers_ReturnsSorted(
 	t *testing.T,
 ) {
@@ -828,8 +876,7 @@ func TestLookupNS_MatchesFindAuthoritative(t *testing.T) {
 // nameservers of g.ntpns.org. The org servers delegate its parent zone,
 // ntpns.org, without the addresses of its nameservers, so the walk has
 // to look them up to ask them. If it did not, the walk for g.ntpns.org
-// would fail and LookupNS would return the nameservers of ntpns.org,
-// which a.ntpns.org is not one of.
+// would fail.
 func TestLookupNS_ParentZoneDelegatedWithoutAddresses(t *testing.T) {
 	t.Parallel()
 
@@ -839,6 +886,131 @@ func TestLookupNS_ParentZoneDelegatedWithoutAddresses(t *testing.T) {
 	assert.Contains(t, nameservers, "a.ntpns.org.")
 }
 
+// TestLookupNS_DomainThatDoesNotExist looks up the nameservers of a .com
+// domain that does not exist. The .com servers answer NXDOMAIN, so the
+// error is ErrNXDomain, and the domain does not get their names.
+func TestLookupNS_DomainThatDoesNotExist(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+
+	var (
+		nameservers []string
+		err         error
+	)
+
+	livednstest.Retry(
+		t,
+		"LookupNS("+nonexistentDomain+")",
+		func(ctx context.Context) error {
+			nameservers, err = r.LookupNS(ctx, nonexistentDomain)
+			if errors.Is(err, resolver.ErrNXDomain) {
+				return nil
+			}
+
+			return err
+		},
+	)
+
+	require.ErrorIs(t, err, resolver.ErrNXDomain)
+	assert.Empty(t, nameservers)
+}
+
+// TestLookupNS_NoDelegationOfItsOwn looks up the nameservers of
+// www.google.com, a name in the google.com zone with no delegation of
+// its own, as a domain such as octocat.github.io is. The google.com
+// servers answer with no NS records for it: the set is empty, and it is
+// not ErrNXDomain.
+func TestLookupNS_NoDelegationOfItsOwn(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+
+	var nameservers []string
+
+	livednstest.Retry(
+		t,
+		"LookupNS(www.google.com)",
+		func(ctx context.Context) error {
+			var err error
+
+			nameservers, err = r.LookupNS(ctx, "www.google.com")
+
+			return err
+		},
+	)
+
+	assert.Empty(t, nameservers)
+}
+
+// TestFollowDelegation_NoAnswer starts the walk LookupNS uses, for
+// google.com, at 192.0.2.1, a documentation address where nothing
+// answers. A walk that got no answer is an error, not an empty set,
+// which the watcher would report as an NS Change with every nameserver
+// removed.
+func TestFollowDelegation_NoAnswer(t *testing.T) {
+	t.Parallel()
+
+	r := resolver.NewWithQueryTimeout(slog.Default(), 100*time.Millisecond)
+
+	nameservers, err := r.FollowDelegation(
+		t.Context(), "google.com.", []string{noAnswerAddress},
+	)
+	require.Error(t, err)
+	assert.Empty(t, nameservers)
+}
+
+// TestResolveNSIterative_NoDelegationOfItsOwn walks to the nameservers
+// of www.google.com as the fallback walk does. As in
+// TestLookupNS_NoDelegationOfItsOwn, the set is empty, with no error.
+func TestResolveNSIterative_NoDelegationOfItsOwn(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+
+	var nameservers []string
+
+	livednstest.Retry(
+		t,
+		"ResolveNSIterative(www.google.com)",
+		func(ctx context.Context) error {
+			var err error
+
+			nameservers, err = r.ResolveNSIterative(ctx, "www.google.com")
+
+			return err
+		},
+	)
+
+	assert.Empty(t, nameservers)
+}
+
+// TestResolveNSIterative_DomainThatDoesNotExist walks to the nameservers
+// of a .com domain that does not exist as the fallback walk does. As in
+// TestLookupNS_DomainThatDoesNotExist, the error is ErrNXDomain.
+func TestResolveNSIterative_DomainThatDoesNotExist(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+
+	var err error
+
+	livednstest.Retry(
+		t,
+		"ResolveNSIterative("+nonexistentDomain+")",
+		func(ctx context.Context) error {
+			_, err = r.ResolveNSIterative(ctx, nonexistentDomain)
+			if errors.Is(err, resolver.ErrNXDomain) {
+				return nil
+			}
+
+			return err
+		},
+	)
+
+	require.ErrorIs(t, err, resolver.ErrNXDomain)
+}
+
 // ----------------------------------------------------------------
 // ResolveIPAddresses tests
 // ----------------------------------------------------------------