docker: a plain docker build . stamps the git version (closes #210)

A plain `docker build .`, which is how upaas builds, stamped `dev`:
`.dockerignore` left out `.git` and the builder declared
`ARG VERSION=dev`. `.dockerignore` now sends `.git` without
`.git/config`, which can hold a credential, and lists no tracked file,
which git would count as deleted. `ARG VERSION` has no default. The
Makefile takes a non-empty `VERSION` from the command line or the
environment, so a build arg still wins; otherwise `git describe` runs in
the builder, which trusts the checkout whoever owns it, as a context
sent as a tar archive keeps its owners. A new `make version` prints the
version; the build fails when the context carries `.git` and it comes
out empty, `dev` or `unknown`.

Model: opus-5-5

.gitea/workflows/check.yml

@@ -1,17 +1,9 @@
 name: check
 on: [push]
-# A new push to a branch cancels that branch's older run, queued or running;
-# runs on other branches, `next` and `main` among them, are left alone.
-concurrency:
-    group: ${{ github.workflow }}-${{ github.ref }}
-    cancel-in-progress: true
 jobs:
     check:
         runs-on: ubuntu-latest
         steps:
             # actions/checkout v4.2.2, 2026-02-28
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-              # script/cibuild needs no token, so none is left in .git/config.
-              with:
-                  persist-credentials: false
             - run: script/cibuild

TODO.md

@@ -21,12 +21,6 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 - 2026-10-02: a plain `docker build .` of a clone stamps its tag or short
   commit, not `dev`: the build context now carries `.git` (closes #210).
-- 2026-10-02: a query a server refuses is not resent asking for recursion, and
-  every root server refusing is reported as DNS interception (closes #206).
-- 2026-10-02: a push to a branch cancels that branch's older CI run, and the
-  checkout leaves no token in `.git/config` (closes #216).
-- 2026-10-02: watcher tests send far fewer queries and a live attempt may take
-  18s; nameserver addresses are asked only for A, AAAA, CNAME (closes #214).
 - 2026-10-02: the resolver tries root servers, and every other server list it
   walks, in a random order each time, not always from the top (closes #138).
 - 2026-10-02: a name listed more than once in `DNSWATCHER_TARGETS`, in any

internal/livednstest/livednstest.go

@@ -36,18 +36,11 @@ const (
 	// before the test fails.
 	attempts = 3
 
-	// AttemptTimeout bounds one attempt. It must fit the longest
-	// operation, a watcher check, which sends over a hundred queries one
-	// after another and on a slow build host takes several times as long
-	// as the few seconds it takes on a fast one. An operation whose
-	// every attempt fails takes attempts * AttemptTimeout plus the
-	// backoff, about 56 seconds, after it waits for one of the
-	// Concurrency slots that every live operation in the test binary
-	// shares. So when live DNS does not answer at all, a test binary
-	// with more live operations than slots runs into the 90-second
-	// `go test -timeout` backstop instead of each test failing on its
-	// own.
-	AttemptTimeout = 18 * time.Second
+	// AttemptTimeout bounds one attempt. Worst case for an operation
+	// is attempts * AttemptTimeout plus the backoff — about 26
+	// seconds, well inside the 90-second `go test -timeout` backstop
+	// even when several operations exhaust their attempts.
+	AttemptTimeout = 8 * time.Second
 
 	// backoffBase is the delay after the first failed attempt; it is
 	// multiplied by backoffFactor each time.

internal/resolver/errors.go

@@ -22,11 +22,6 @@ var (
 		"reply is an error or a referral that leads no closer",
 	)
 
-	// ErrIntercepted is returned when every root server refused a
-	// query. Root servers refuse no query, so the refusals came from
-	// something on the network answering in their place.
-	ErrIntercepted = errors.New("this network intercepts DNS queries")
-
 	// ErrCNAMEDepthExceeded is returned when a CNAME chain
 	// exceeds MaxCNAMEDepth.
 	ErrCNAMEDepthExceeded = errors.New(

internal/resolver/export_test.go

@@ -28,24 +28,13 @@ func CollectIPs(
 	return collectIPs(results)
 }
 
-// QueryServers exports queryServers for testing.
-func (r *Resolver) QueryServers(
-	ctx context.Context,
-	servers []string,
-	zone string,
-	name string,
-	qtype uint16,
-) (*dns.Msg, error) {
-	return r.queryServers(ctx, servers, zone, name, qtype)
-}
-
 // QueryEachNS exports queryEachNS for testing.
 func (r *Resolver) QueryEachNS(
 	ctx context.Context,
 	nameservers []string,
 	hostname string,
 ) (map[string]*NameserverResponse, error) {
-	return r.queryEachNS(ctx, nameservers, hostname, recordTypes())
+	return r.queryEachNS(ctx, nameservers, hostname)
 }
 
 // ResolveNSIPs exports resolveNSIPs for testing.

internal/resolver/iterative.go

@@ -107,8 +107,9 @@ func (r *Resolver) retryTCP(
 	return resp
 }
 
-// queryDNS sends a DNS query to a specific server IP, never asking it
-// for recursion. A reply of REFUSED is returned as ErrRefused.
+// queryDNS sends a DNS query to a specific server IP.
+// Tries non-recursive first, falls back to recursive on
+// REFUSED (handles DNS interception environments).
 func (r *Resolver) queryDNS(
 	ctx context.Context,
 	serverIP string,
@@ -131,13 +132,26 @@ func (r *Resolver) queryDNS(
 		return nil, fmt.Errorf("query %s @%s: %w", name, serverIP, err)
 	}
 
+	if resp.Rcode == dns.RcodeRefused {
+		msg.RecursionDesired = true
+
+		resp, err = r.tryExchange(ctx, msg, addr)
+		if err != nil {
+			return nil, fmt.Errorf(
+				"query %s @%s: %w", name, serverIP, err,
+			)
+		}
+
 		if resp.Rcode == dns.RcodeRefused {
 			return nil, fmt.Errorf(
 				"query %s @%s: %w", name, serverIP, ErrRefused,
 			)
 		}
+	}
 
-	return r.retryTCP(ctx, msg, addr, resp), nil
+	resp = r.retryTCP(ctx, msg, addr, resp)
+
+	return resp, nil
 }
 
 func extractNSSet(rrs []dns.RR) []string {
@@ -265,9 +279,7 @@ func shuffled(
 
 // queryServers asks servers, the servers of zone, about name in a random
 // order until one gives a usable reply. A server that times out, refuses
-// or gives a reply that is not usable is passed over for the next. When
-// every server refused, the error says so, and when they are the root
-// servers it is ErrIntercepted.
+// or gives a reply that is not usable is passed over for the next.
 func (r *Resolver) queryServers(
 	ctx context.Context,
 	servers []string,
@@ -277,8 +289,6 @@ func (r *Resolver) queryServers(
 ) (*dns.Msg, error) {
 	var lastErr error
 
-	refused := 0
-
 	for _, ip := range shuffled(servers, rand.Shuffle) {
 		if checkCtx(ctx) != nil {
 			return nil, ErrContextCanceled
@@ -295,27 +305,9 @@ func (r *Resolver) queryServers(
 			return resp, nil
 		}
 
-		if errors.Is(err, ErrRefused) {
-			refused++
-		}
-
 		lastErr = err
 	}
 
-	if refused == len(servers) && zone == "." {
-		return nil, fmt.Errorf(
-			"every root server refused a query for %s: %w",
-			name, ErrIntercepted,
-		)
-	}
-
-	if refused == len(servers) {
-		return nil, fmt.Errorf(
-			"every server of %s refused a query for %s: %w",
-			zone, name, ErrRefused,
-		)
-	}
-
 	return nil, fmt.Errorf("all servers failed: %w", lastErr)
 }
 
@@ -536,49 +528,17 @@ func (r *Resolver) FindAuthoritativeNameservers(
 
 			return nsNames, nil
 		}
-
-		// The root servers would refuse every parent name too.
-		if errors.Is(err, ErrIntercepted) {
-			return nil, err
-		}
 	}
 
 	return nil, ErrNoNameservers
 }
 
-// recordTypes returns the record types a nameserver is asked for when a
-// name is checked.
-func recordTypes() []uint16 {
-	return []uint16{
-		dns.TypeA, dns.TypeAAAA, dns.TypeCNAME,
-		dns.TypeMX, dns.TypeTXT, dns.TypeSRV,
-		dns.TypeCAA, dns.TypeNS,
-	}
-}
-
-// addressTypes returns the record types ResolveIPAddresses asks for,
-// the only ones it reads.
-func addressTypes() []uint16 {
-	return []uint16{dns.TypeA, dns.TypeAAAA, dns.TypeCNAME}
-}
-
 // QueryNameserver queries a specific nameserver for all record
 // types and builds a NameserverResponse.
 func (r *Resolver) QueryNameserver(
 	ctx context.Context,
 	nsHostname string,
 	hostname string,
-) (*NameserverResponse, error) {
-	return r.queryNameserver(ctx, nsHostname, hostname, recordTypes())
-}
-
-// queryNameserver queries a specific nameserver for the record types
-// in qtypes and builds a NameserverResponse.
-func (r *Resolver) queryNameserver(
-	ctx context.Context,
-	nsHostname string,
-	hostname string,
-	qtypes []uint16,
 ) (*NameserverResponse, error) {
 	if checkCtx(ctx) != nil {
 		return nil, ErrContextCanceled
@@ -591,7 +551,7 @@ func (r *Resolver) queryNameserver(
 
 	hostname = dns.Fqdn(hostname)
 
-	return r.queryTypes(ctx, nsHostname, nsIPs[0], hostname, qtypes)
+	return r.queryAllTypes(ctx, nsHostname, nsIPs[0], hostname)
 }
 
 // QueryNameserverIP queries a nameserver by its IP address directly,
@@ -608,15 +568,14 @@ func (r *Resolver) QueryNameserverIP(
 
 	hostname = dns.Fqdn(hostname)
 
-	return r.queryTypes(ctx, nsHostname, nsIP, hostname, recordTypes())
+	return r.queryAllTypes(ctx, nsHostname, nsIP, hostname)
 }
 
-func (r *Resolver) queryTypes(
+func (r *Resolver) queryAllTypes(
 	ctx context.Context,
 	nsHostname string,
 	nsIP string,
 	hostname string,
-	qtypes []uint16,
 ) (*NameserverResponse, error) {
 	resp := &NameserverResponse{
 		Nameserver: nsHostname,
@@ -624,6 +583,12 @@ func (r *Resolver) queryTypes(
 		Status:     StatusOK,
 	}
 
+	qtypes := []uint16{
+		dns.TypeA, dns.TypeAAAA, dns.TypeCNAME,
+		dns.TypeMX, dns.TypeTXT, dns.TypeSRV,
+		dns.TypeCAA, dns.TypeNS,
+	}
+
 	state := r.queryEachType(ctx, nsIP, hostname, qtypes, resp)
 	classifyResponse(resp, state)
 
@@ -814,19 +779,18 @@ func (r *Resolver) QueryAllNameservers(
 		return nil, err
 	}
 
-	return r.queryEachNS(ctx, nameservers, hostname, recordTypes())
+	return r.queryEachNS(ctx, nameservers, hostname)
 }
 
 func (r *Resolver) queryEachNS(
 	ctx context.Context,
 	nameservers []string,
 	hostname string,
-	qtypes []uint16,
 ) (map[string]*NameserverResponse, error) {
 	results := make(map[string]*NameserverResponse)
 
 	for _, ns := range nameservers {
-		resp, err := r.queryNameserver(ctx, ns, hostname, qtypes)
+		resp, err := r.QueryNameserver(ctx, ns, hostname)
 
 		// A query the context cut short says nothing about the
 		// nameserver, so it must not be returned as its failure.
@@ -871,10 +835,9 @@ func (r *Resolver) LookupAllRecords(
 }
 
 // ResolveIPAddresses resolves a hostname to all IPv4 and IPv6
-// addresses, following CNAME chains up to MaxCNAMEDepth. It asks each
-// nameserver of the name's zone for its A, AAAA and CNAME records only.
-// When no nameserver of the name's zone answered, it returns an error
-// rather than no addresses.
+// addresses, following CNAME chains up to MaxCNAMEDepth. When no
+// nameserver of the name's zone answered, it returns an error rather
+// than no addresses.
 func (r *Resolver) ResolveIPAddresses(
 	ctx context.Context,
 	hostname string,
@@ -895,12 +858,7 @@ func (r *Resolver) resolveIPWithCNAME(
 		return nil, ErrCNAMEDepthExceeded
 	}
 
-	nameservers, err := r.FindAuthoritativeNameservers(ctx, hostname)
-	if err != nil {
-		return nil, err
-	}
-
-	results, err := r.queryEachNS(ctx, nameservers, hostname, addressTypes())
+	results, err := r.QueryAllNameservers(ctx, hostname)
 	if err != nil {
 		return nil, err
 	}

internal/resolver/resolver_test.go

@@ -11,7 +11,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -296,187 +295,6 @@ func TestQueryNameserver_Refused(t *testing.T) {
 	assert.Equal(t, "server returned REFUSED", resp.Error)
 }
 
-// TestQueryNameserverIP_RecursiveResolverRefused asks Quad9, a public
-// recursive resolver, about google.com at both of its addresses. Quad9
-// refuses a query that does not ask for recursion and answers one that
-// does. The resolver never asks for recursion, so it must be reported
-// as refusing, never as answering.
-func TestQueryNameserverIP_RecursiveResolverRefused(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-
-	for _, ip := range []string{"9.9.9.9", "149.112.112.112"} {
-		var resp *resolver.NameserverResponse
-
-		livednstest.Retry(
-			t,
-			"QueryNameserverIP("+ip+", google.com)",
-			func(ctx context.Context) error {
-				var err error
-
-				resp, err = r.QueryNameserverIP(
-					ctx, ip, ip, "google.com",
-				)
-				if err != nil {
-					return err
-				}
-
-				// A timeout or a network error is no reply at all.
-				if resp.Status == resolver.StatusTimeout ||
-					strings.HasPrefix(resp.Error, "network error") {
-					return fmt.Errorf(
-						"%w: %s: %s",
-						livednstest.ErrNoAnswer, ip, resp.Error,
-					)
-				}
-
-				return nil
-			},
-		)
-
-		assert.Equal(t, resolver.StatusError, resp.Status, ip)
-		assert.Equal(t, "server returned REFUSED", resp.Error, ip)
-	}
-}
-
-// googleNameserverIPv4s returns the IPv4 addresses of google.com's
-// nameservers, the only addresses the resolver asks servers at.
-func googleNameserverIPv4s(t *testing.T, r *resolver.Resolver) []string {
-	t.Helper()
-
-	names := liveFindAuthoritative(t, r, "google.com")
-
-	return liveResolveNSIPs(t, r, names, len(names))
-}
-
-// TestQueryServers_EveryServerRefused asks all of google.com's
-// nameservers about cloudflare.com, a zone they do not serve, which
-// they all refuse. The error says every server refused; it is not
-// ErrIntercepted, which only the root servers refusing shows.
-func TestQueryServers_EveryServerRefused(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-	servers := googleNameserverIPv4s(t, r)
-
-	var err error
-
-	livednstest.Retry(
-		t,
-		"QueryServers(google.com servers, cloudflare.com)",
-		func(ctx context.Context) error {
-			_, err = r.QueryServers(
-				ctx, servers, "google.com.", "cloudflare.com.",
-				dns.TypeNS,
-			)
-
-			// When not every server refused, one may have given no
-			// reply at all, so the attempt is tried again.
-			if err != nil &&
-				!strings.HasPrefix(err.Error(), "every server of") {
-				return fmt.Errorf(
-					"%w: %w", livednstest.ErrNoAnswer, err,
-				)
-			}
-
-			return nil
-		},
-	)
-
-	require.ErrorIs(t, err, resolver.ErrRefused)
-	require.NotErrorIs(t, err, resolver.ErrIntercepted)
-	require.EqualError(
-		t, err,
-		"every server of google.com. refused a query for "+
-			"cloudflare.com.: dns query refused",
-	)
-}
-
-// TestQueryServers_EveryRootServerRefused passes google.com's
-// nameservers to QueryServers as the servers of the root zone. They
-// refuse a query about cloudflare.com, as root servers would if
-// something on the network answered in their place, so the error is
-// ErrIntercepted.
-func TestQueryServers_EveryRootServerRefused(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-	servers := googleNameserverIPv4s(t, r)
-
-	var err error
-
-	livednstest.Retry(
-		t,
-		"QueryServers(google.com servers as root servers, cloudflare.com)",
-		func(ctx context.Context) error {
-			_, err = r.QueryServers(
-				ctx, servers, ".", "cloudflare.com.", dns.TypeNS,
-			)
-
-			// When not every server refused, one may have given no
-			// reply at all, so the attempt is tried again. Both errors
-			// for every server refusing say "refused a query for".
-			if err != nil &&
-				!strings.Contains(err.Error(), "refused a query for") {
-				return fmt.Errorf(
-					"%w: %w", livednstest.ErrNoAnswer, err,
-				)
-			}
-
-			return nil
-		},
-	)
-
-	require.ErrorIs(t, err, resolver.ErrIntercepted)
-	require.EqualError(
-		t, err,
-		"every root server refused a query for cloudflare.com.: "+
-			"this network intercepts DNS queries",
-	)
-}
-
-// TestQueryServers_NotEveryRootServerRefused passes google.com's
-// nameservers and 192.0.2.1 to QueryServers as the servers of the root
-// zone. The google.com nameservers refuse a query about cloudflare.com,
-// but nothing answers at 192.0.2.1, a documentation address, so not
-// every server refused, wherever 192.0.2.1 falls in the random order:
-// the error is not ErrIntercepted and does not say every server refused.
-func TestQueryServers_NotEveryRootServerRefused(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-	servers := googleNameserverIPv4s(t, r)
-	servers = append(servers, "192.0.2.1")
-
-	var err error
-
-	livednstest.Retry(
-		t,
-		"QueryServers(google.com servers and 192.0.2.1, cloudflare.com)",
-		func(ctx context.Context) error {
-			_, err = r.QueryServers(
-				ctx, servers, ".", "cloudflare.com.", dns.TypeNS,
-			)
-
-			// An attempt that ran out of time may not have asked every
-			// server, so it is tried again.
-			if ctx.Err() != nil {
-				return fmt.Errorf(
-					"%w: %w", livednstest.ErrNoAnswer, err,
-				)
-			}
-
-			return nil
-		},
-	)
-
-	require.Error(t, err)
-	require.NotErrorIs(t, err, resolver.ErrIntercepted)
-	// Both errors for every server refusing say "refused a query for".
-	require.NotContains(t, err.Error(), "refused a query for")
-}
-
 func TestQueryNameserver_RecordsSorted(t *testing.T) {
 	t.Parallel()
 
@@ -744,34 +562,6 @@ func TestResolveIPAddresses_CloudflareDomain(t *testing.T) {
 	assert.NotEmpty(t, ips)
 }
 
-// TestResolveIPAddresses_NameserverIPv4AndIPv6 looks up the addresses of
-// one of cloudflare.com's nameservers, as a domain check does for each
-// nameserver. That name has A and AAAA records, so both kinds of address
-// come back.
-func TestResolveIPAddresses_NameserverIPv4AndIPv6(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "cloudflare.com")
-	ips := liveResolveIPs(t, r, ns)
-
-	var ipv4, ipv6 int
-
-	for _, ip := range ips {
-		parsed := net.ParseIP(ip)
-		require.NotNil(t, parsed, "should be valid IP: %s", ip)
-
-		if parsed.To4() != nil {
-			ipv4++
-		} else {
-			ipv6++
-		}
-	}
-
-	assert.Positive(t, ipv4, "no IPv4 address for %s: %v", ns, ips)
-	assert.Positive(t, ipv6, "no IPv6 address for %s: %v", ns, ips)
-}
-
 // ----------------------------------------------------------------
 // Context cancellation tests
 // ----------------------------------------------------------------

internal/watcher/watcher_test.go

@@ -26,22 +26,18 @@ import (
 
 // The watcher looks these names up in live DNS with the real resolver,
 // so tests assert on what the watcher does with the answers, never on
-// the records these zones publish. The nameservers of testHost and
-// testSmallDomain stay the same between a test looking them up and its
-// check. Every query a check sends is one more that can be lost, so the
-// tests keep them few. A check asks each of a name's nameservers about
-// every record type, and both names have two. A domain check also looks
-// up each nameserver's addresses at every nameserver of the zone that
-// nameserver is in: testSmallDomain's nameservers are in zones with two
-// nameservers, while a domain whose nameservers are in, say,
-// cloudflare.com, which has five, makes each domain check much longer.
-// A test checks a domain only when it is about domains, and checks once,
-// from saved state it builds, rather than twice. The tests that query
-// testDomain's nameservers directly do no domain check.
+// the records these zones publish. testHost's nameservers and addresses
+// stay the same from one check to the next, which the tests that check
+// it twice rely on, and testSmallDomain's nameservers stay the same
+// between a test looking them up and its check. A domain check looks up
+// each nameserver's addresses, about a second per nameserver, so the
+// tests that check a domain use testSmallDomain, which has two
+// nameservers, and check it once. The tests that query testDomain's
+// nameservers directly do no domain check.
 const (
 	testDomain      = "google.com"
-	testSmallDomain = "desec.io"
-	testHost        = "example.org"
+	testSmallDomain = "example.com"
+	testHost        = "cloudflare.com"
 	testIssuer      = "DigiCert"
 )
 
@@ -263,48 +259,55 @@ func checkOnce(
 
 // runChecks builds a watcher, lets prepare set up the saved state and
 // stand-ins it starts from, and runs its checks once against live DNS.
-// When the check finds no fresh address for a name (see checkOnce), the
-// watcher is thrown away and all of this runs again on a new one, so a
-// failed attempt leaves nothing behind in the saved state, the
-// stand-ins or the notifications.
+// If change is not nil, change then alters the saved state or stand-ins
+// and the checks run a second time. When either check finds no fresh
+// address for a name (see checkOnce), the watcher is thrown away and
+// all of this runs again on a new one, so a failed attempt leaves
+// nothing behind in the saved state, the stand-ins or the notifications.
 func runChecks(
 	t *testing.T,
 	cfg *config.Config,
-	prepare func(deps *testDeps),
-) (*watcher.Watcher, *testDeps) {
+	prepare, change func(deps *testDeps),
+) *testDeps {
 	t.Helper()
 
-	var (
-		w    *watcher.Watcher
-		deps *testDeps
-	)
+	var deps *testDeps
 
 	livednstest.Retry(t, "watcher checks", func(ctx context.Context) error {
+		var w *watcher.Watcher
+
 		w, deps = newTestWatcher(t, cfg)
 
 		if prepare != nil {
 			prepare(deps)
 		}
 
+		err := checkOnce(ctx, w, deps)
+		if err != nil || change == nil {
+			return err
+		}
+
+		change(deps)
+
 		return checkOnce(ctx, w, deps)
 	})
 
-	return w, deps
+	return deps
 }
 
-// lookupNameservers returns the nameservers live DNS lists for name,
+// lookupNameservers returns the nameservers live DNS lists for domain,
 // for a test to save in the state its check starts from.
-func lookupNameservers(t *testing.T, name string) []string {
+func lookupNameservers(t *testing.T, domain string) []string {
 	t.Helper()
 
 	res := resolver.NewFromLogger(slog.Default())
 
 	var nameservers []string
 
-	livednstest.Retry(t, "LookupNS("+name+")", func(ctx context.Context) error {
+	livednstest.Retry(t, "LookupNS("+domain+")", func(ctx context.Context) error {
 		var err error
 
-		nameservers, err = res.LookupNS(ctx, name)
+		nameservers, err = res.LookupNS(ctx, domain)
 
 		return err
 	})
@@ -367,7 +370,7 @@ func TestFirstRunBaseline(t *testing.T) {
 	cfg.Domains = []string{testSmallDomain}
 	cfg.Hostnames = []string{testHost}
 
-	_, deps := runChecks(t, cfg, nil)
+	deps := runChecks(t, cfg, nil, nil)
 
 	assertNoNotifications(t, deps)
 	assertStatePopulated(t, deps)
@@ -419,7 +422,7 @@ func TestDomainPortAndTLSChecks(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{testSmallDomain}
 
-	_, deps := runChecks(t, cfg, nil)
+	deps := runChecks(t, cfg, nil, nil)
 
 	snap := deps.state.GetSnapshot()
 
@@ -459,11 +462,11 @@ func TestNSChangeDetection(t *testing.T) {
 	cfg.Domains = []string{testSmallDomain}
 
 	// The saved state lists nameservers that live DNS does not.
-	_, deps := runChecks(t, cfg, func(deps *testDeps) {
+	deps := runChecks(t, cfg, func(deps *testDeps) {
 		deps.state.SetDomainState(testSmallDomain, &state.DomainState{
 			Nameservers: []string{oldNS1, oldNS2},
 		})
-	})
+	}, nil)
 
 	assertNotified(t, deps, "NS Change: "+testSmallDomain, "warning")
 
@@ -483,7 +486,7 @@ func TestNSAddressChangeDetection(t *testing.T) {
 
 	// The saved state lists the nameservers live DNS lists, each at an
 	// address live DNS never returns.
-	_, deps := runChecks(t, cfg, func(deps *testDeps) {
+	deps := runChecks(t, cfg, func(deps *testDeps) {
 		nsAddresses := make(map[string][]string, len(nameservers))
 		for _, ns := range nameservers {
 			nsAddresses[ns] = []string{oldIP}
@@ -493,7 +496,7 @@ func TestNSAddressChangeDetection(t *testing.T) {
 			Nameservers:         nameservers,
 			NameserverAddresses: nsAddresses,
 		})
-	})
+	}, nil)
 
 	title := "NS Address Change: " + testSmallDomain
 	ds, _ := deps.state.GetDomainState(testSmallDomain)
@@ -539,12 +542,12 @@ func TestNSAddedAndRemovedIsNoAddressChange(t *testing.T) {
 	// The saved state lists oldNS1, which live DNS does not, in place of
 	// the first nameserver live DNS lists, so that the check finds that
 	// one added and oldNS1 removed. Only oldNS1 has addresses saved.
-	_, deps := runChecks(t, cfg, func(deps *testDeps) {
+	deps := runChecks(t, cfg, func(deps *testDeps) {
 		deps.state.SetDomainState(testSmallDomain, &state.DomainState{
 			Nameservers:         append([]string{oldNS1}, nameservers[1:]...),
 			NameserverAddresses: map[string][]string{oldNS1: {oldIP}},
 		})
-	})
+	}, nil)
 
 	if n := countNotifications(deps, "NS Change: "+testSmallDomain); n != 1 {
 		t.Errorf("sent %d NS changes, want 1", n)
@@ -562,17 +565,15 @@ func TestRecordChangeDetection(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	nameservers := lookupNameservers(t, testHost)
-
-	// The saved state has every nameserver live DNS lists answering
-	// with an address live DNS never returns.
-	_, deps := runChecks(t, cfg, func(deps *testDeps) {
-		byNameserver := make(map[string]*state.NameserverRecordState)
-		for _, ns := range nameservers {
-			byNameserver[ns] = answered(map[string][]string{"A": {oldIP}})
+	// Between the checks, save for every nameserver an address live DNS
+	// never returns.
+	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
+		hs, _ := deps.state.GetHostnameState(testHost)
+		for _, nsState := range hs.RecordsByNameserver {
+			nsState.Records = map[string][]string{"A": {oldIP}}
 		}
 
-		deps.state.SetHostnameState(testHost, saved(byNameserver))
+		deps.state.SetHostnameState(testHost, hs)
 	})
 
 	assertNotified(t, deps, "Record Change: "+testHost, "warning")
@@ -584,15 +585,12 @@ func TestPortStateChange(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	w, deps := runChecks(t, cfg, nil)
-
-	// Every port closes, and the port checks run again. They look
-	// nothing up.
+	// Between the checks, every port closes.
+	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
 		deps.portChecker.mu.Lock()
 		deps.portChecker.closed = true
 		deps.portChecker.mu.Unlock()
-
-	w.CheckAllPorts(t.Context())
+	})
 
 	hs, _ := deps.state.GetHostnameState(testHost)
 	assertNotified(
@@ -612,7 +610,7 @@ func TestTLSExpiryWarning(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	_, deps := runChecks(t, cfg, expiresInThreeDays)
+	deps := runChecks(t, cfg, expiresInThreeDays, nil)
 
 	assertNotified(t, deps, "TLS Expiry Warning: "+testHost, "warning")
 }
@@ -784,7 +782,7 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 	cfg.Hostnames = []string{testHost}
 
 	// The saved state says the last check found testHost at oldIP.
-	_, deps := runChecks(t, cfg, func(deps *testDeps) {
+	deps := runChecks(t, cfg, func(deps *testDeps) {
 		deps.state.SetHostnameState(testHost, &state.HostnameState{
 			RecordsByNameserver: map[string]*state.NameserverRecordState{
 				oldNS1: {
@@ -793,7 +791,7 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 				},
 			},
 		})
-	})
+	}, nil)
 
 	snap := deps.state.GetSnapshot()
 
@@ -924,20 +922,21 @@ func TestNSFailureAndRecovery(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	nameservers := lookupNameservers(t, testHost)
-
-	// The saved state has every nameserver live DNS lists as one that
-	// did not answer, and, as answering, one that live DNS does not
-	// list, which then disappears.
-	_, deps := runChecks(t, cfg, func(deps *testDeps) {
-		byNameserver := map[string]*state.NameserverRecordState{
-			oldNS1: answered(map[string][]string{"A": {oldIP}}),
-		}
-		for _, ns := range nameservers {
-			byNameserver[ns] = failed()
+	// Between the checks, save every nameserver the first check found
+	// as one that did not answer, and add, as answering, one that live
+	// DNS does not list, which then disappears.
+	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
+		hs, _ := deps.state.GetHostnameState(testHost)
+		for ns := range hs.RecordsByNameserver {
+			hs.RecordsByNameserver[ns] = failed()
 		}
 
-		deps.state.SetHostnameState(testHost, saved(byNameserver))
+		hs.RecordsByNameserver[oldNS1] = &state.NameserverRecordState{
+			Records: map[string][]string{"A": {oldIP}},
+			Status:  "ok",
+		}
+
+		deps.state.SetHostnameState(testHost, hs)
 	})
 
 	assertNotified(t, deps, "NS Failure: "+testHost, "error")