resolver: a reply marked recursion available from a root server's address stops the lookup (closes #300)

dnswatcher never asks for recursion and a root server never offers it,
so a reply marked recursion available from a root server's address
came from a resolver on the network answering in its place. The first
such reply now stops the lookup at once with the existing "this network
intercepts DNS queries", naming the address, and no other root server
is asked, whether or not that resolver had the name cached. Before, a
cached name was checked against the resolver's second-hand answer.

On such a network dnswatcher and its tests fail with that error, by
design; nothing works around the interception. A live test passes
public resolvers as the root servers and expects the error.

Model: opus-5-5

internal/resolver/resolver_test.go

@@ -850,6 +850,63 @@ func TestQueryServers_NotEveryRootServerRefused(t *testing.T) {
 	require.NotContains(t, err.Error(), "refused a query for")
 }
 
+// TestQueryServers_RecursiveResolversAsRootServers passes public
+// recursive resolvers of four operators to QueryServers as the servers
+// of the root zone, as a network that sends every DNS query to a
+// resolver would. Their replies are marked recursion available, which
+// no root server's is: SERVFAIL, or an answer from a resolver's cache,
+// as 1.1.1.1 gives for com., which would be used if a root server gave
+// it. The first such reply ends the lookup with ErrIntercepted, naming
+// the resolver that gave it. A resolver that refuses or gives no reply
+// is passed over for the next, so one of them answering is enough.
+func TestQueryServers_RecursiveResolversAsRootServers(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	resolvers := []string{
+		"1.1.1.1", "8.8.8.8", "9.9.9.9", "208.67.222.222",
+	}
+
+	for _, name := range []string{"com.", "desec.io."} {
+		var err error
+
+		livednstest.Retry(
+			t,
+			"QueryServers(public recursive resolvers as root servers, "+
+				name+")",
+			func(ctx context.Context) error {
+				_, err = r.QueryServers(ctx, resolvers, ".", name, dns.TypeNS)
+
+				// When no resolver gave a reply marked recursion
+				// available, each refused or gave no reply at all, so
+				// the attempt is tried again.
+				if err != nil &&
+					!strings.Contains(err.Error(), "marked recursion available") {
+					return fmt.Errorf(
+						"%w: %w", livednstest.ErrNoAnswer, err,
+					)
+				}
+
+				return nil
+			},
+		)
+
+		require.ErrorIs(t, err, resolver.ErrIntercepted)
+
+		// The error names the resolver whose reply ended the lookup.
+		messages := make([]string, 0, len(resolvers))
+		for _, ip := range resolvers {
+			messages = append(messages,
+				"query "+name+" @"+ip+": reply marked recursion "+
+					"available, so not from a root server: "+
+					"this network intercepts DNS queries",
+			)
+		}
+
+		require.Contains(t, messages, err.Error())
+	}
+}
+
 func TestQueryNameserver_RecordsSorted(t *testing.T) {
 	t.Parallel()