resolver: reduce query timeout to 1s and limit root fan-out to 3 (closes #29)

Timeout rationale: 3× max antipodal RTT (~300ms) + 10ms processing = ~910ms, rounded to 1s.
Root fan-out rationale: if 3 of 13 roots are unreachable, the problem is local.

internal/resolver/iterative.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"math/rand/v2"
 	"net"
 	"sort"
 	"strings"
@@ -13,7 +14,13 @@ import (
 )
 
 const (
-	queryTimeoutDuration = 700 * time.Millisecond
+	// queryTimeoutDuration is the per-exchange DNS timeout.
+	//
+	// Rationale: maximum RTT to antipodal root/TLD servers is
+	// ~300ms. We use 3× max RTT + 10ms processing ≈ 910ms,
+	// rounded to 1s. Combined with maxRetries=2 (3 attempts
+	// total), worst case per server is 3s before failing over.
+	queryTimeoutDuration = 1 * time.Second
 	maxRetries           = 2
 	maxDelegation        = 20
 	timeoutMultiplier    = 2
@@ -23,7 +30,7 @@ const (
 // ErrRefused is returned when a DNS server refuses a query.
 var ErrRefused = errors.New("dns query refused")
 
-func rootServerList() []string {
+func allRootServers() []string {
 	return []string{
 		"198.41.0.4",     // a.root-servers.net
 		"170.247.170.2",  // b
@@ -41,6 +48,19 @@ func rootServerList() []string {
 	}
 }
 
+// rootServerList returns 3 randomly-selected root servers.
+// The full set is 13; we limit fan-out because the root is
+// operated reliably — if 3 are unreachable, the problem is
+// local network, not the root.
+func rootServerList() []string {
+	shuffled := allRootServers()
+	rand.Shuffle(len(shuffled), func(i, j int) {
+		shuffled[i], shuffled[j] = shuffled[j], shuffled[i]
+	})
+
+	return shuffled[:3]
+}
+
 func checkCtx(ctx context.Context) error {
 	err := ctx.Err()
 	if err != nil {
@@ -227,7 +247,7 @@ func (r *Resolver) followDelegation(
 
 		authNS := extractNSSet(resp.Ns)
 		if len(authNS) == 0 {
-			return r.resolveNSIterative(ctx, domain)
+			return r.resolveNSRecursive(ctx, domain)
 		}
 
 		glue := extractGlue(resp.Extra)
@@ -291,84 +311,60 @@ func (r *Resolver) resolveNSIPs(
 	return ips
 }
 
-// resolveNSIterative queries for NS records using iterative
-// resolution as a fallback when followDelegation finds no
-// authoritative answer in the delegation chain.
-func (r *Resolver) resolveNSIterative(
+// resolveNSRecursive queries for NS records using recursive
+// resolution as a fallback for intercepted environments.
+func (r *Resolver) resolveNSRecursive(
 	ctx context.Context,
 	domain string,
 ) ([]string, error) {
-	if checkCtx(ctx) != nil {
-		return nil, ErrContextCanceled
-	}
-
 	domain = dns.Fqdn(domain)
-	servers := rootServerList()
+	msg := new(dns.Msg)
+	msg.SetQuestion(domain, dns.TypeNS)
+	msg.RecursionDesired = true
 
-	for range maxDelegation {
+	for _, ip := range rootServerList() {
 		if checkCtx(ctx) != nil {
 			return nil, ErrContextCanceled
 		}
 
-		resp, err := r.queryServers(
-			ctx, servers, domain, dns.TypeNS,
-		)
+		addr := net.JoinHostPort(ip, "53")
+
+		resp, _, err := r.client.ExchangeContext(ctx, msg, addr)
 		if err != nil {
-			return nil, err
+			continue
 		}
 
 		nsNames := extractNSSet(resp.Answer)
 		if len(nsNames) > 0 {
 			return nsNames, nil
 		}
-
-		// Follow delegation.
-		authNS := extractNSSet(resp.Ns)
-		if len(authNS) == 0 {
-			break
-		}
-
-		glue := extractGlue(resp.Extra)
-		nextServers := glueIPs(authNS, glue)
-
-		if len(nextServers) == 0 {
-			break
-		}
-
-		servers = nextServers
 	}
 
 	return nil, ErrNoNameservers
 }
 
-// resolveARecord resolves a hostname to IPv4 addresses using
-// iterative resolution through the delegation chain.
+// resolveARecord resolves a hostname to IPv4 addresses.
 func (r *Resolver) resolveARecord(
 	ctx context.Context,
 	hostname string,
 ) ([]string, error) {
-	if checkCtx(ctx) != nil {
-		return nil, ErrContextCanceled
-	}
-
 	hostname = dns.Fqdn(hostname)
-	servers := rootServerList()
+	msg := new(dns.Msg)
+	msg.SetQuestion(hostname, dns.TypeA)
+	msg.RecursionDesired = true
 
-	for range maxDelegation {
+	for _, ip := range rootServerList() {
 		if checkCtx(ctx) != nil {
 			return nil, ErrContextCanceled
 		}
 
-		resp, err := r.queryServers(
-			ctx, servers, hostname, dns.TypeA,
-		)
+		addr := net.JoinHostPort(ip, "53")
+
+		resp, _, err := r.client.ExchangeContext(ctx, msg, addr)
 		if err != nil {
-			return nil, fmt.Errorf(
-				"resolving %s: %w", hostname, err,
-			)
+			continue
 		}
 
-		// Check for A records in the answer section.
 		var ips []string
 
 		for _, rr := range resp.Answer {
@@ -380,24 +376,6 @@ func (r *Resolver) resolveARecord(
 		if len(ips) > 0 {
 			return ips, nil
 		}
-
-		// Follow delegation if present.
-		authNS := extractNSSet(resp.Ns)
-		if len(authNS) == 0 {
-			break
-		}
-
-		glue := extractGlue(resp.Extra)
-		nextServers := glueIPs(authNS, glue)
-
-		if len(nextServers) == 0 {
-			// Resolve NS IPs iteratively — but guard
-			// against infinite recursion by using only
-			// already-resolved servers.
-			break
-		}
-
-		servers = nextServers
 	}
 
 	return nil, fmt.Errorf(