resolver: a root server's reply marked recursion available means interception (closes #300)

dnswatcher never asks for recursion and a root server never offers it,
so a reply marked recursion available from a root server's address
came from a resolver on the network answering in its place. Such a
reply is now passed over, and when every root server refused or gave
one, the lookup fails with the existing "this network intercepts DNS
queries", whether or not that resolver had the name cached. Before, a
cached name was checked against the resolver's second-hand answer.

On such a network dnswatcher and its tests fail with that error, by
design; nothing asks again another way or works around it. A live test
passes public resolvers as the root servers and expects the error.

Model: opus-5-5

internal/resolver/resolver_test.go

@@ -850,6 +850,55 @@ func TestQueryServers_NotEveryRootServerRefused(t *testing.T) {
 	require.NotContains(t, err.Error(), "refused a query for")
 }
 
+// TestQueryServers_RecursiveResolversAsRootServers passes public
+// recursive resolvers of four operators to QueryServers as the servers
+// of the root zone, as a network that sends every DNS query to a
+// resolver would. Each refuses the query or gives a reply marked
+// recursion available, which no root server does: SERVFAIL, or an
+// answer from its cache, as 1.1.1.1 gives for com., which would be used
+// if a root server gave it. Either way the error is ErrIntercepted, and
+// since 1.1.1.1 and 8.8.8.8 refuse no such query, it says a reply was
+// marked recursion available.
+func TestQueryServers_RecursiveResolversAsRootServers(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	resolvers := []string{
+		"1.1.1.1", "8.8.8.8", "9.9.9.9", "208.67.222.222",
+	}
+
+	for _, name := range []string{"com.", "desec.io."} {
+		var err error
+
+		livednstest.Retry(
+			t,
+			"QueryServers(public recursive resolvers as root servers, "+
+				name+")",
+			func(ctx context.Context) error {
+				_, err = r.QueryServers(ctx, resolvers, ".", name, dns.TypeNS)
+
+				// When the error is another, one resolver may have given
+				// no reply at all, so the attempt is tried again.
+				if err != nil && !errors.Is(err, resolver.ErrIntercepted) {
+					return fmt.Errorf(
+						"%w: %w", livednstest.ErrNoAnswer, err,
+					)
+				}
+
+				return nil
+			},
+		)
+
+		require.ErrorIs(t, err, resolver.ErrIntercepted)
+		require.EqualError(
+			t, err,
+			"every root server refused a query for "+name+" or gave a "+
+				"reply marked recursion available: "+
+				"this network intercepts DNS queries",
+		)
+	}
+}
+
 func TestQueryNameserver_RecordsSorted(t *testing.T) {
 	t.Parallel()