state: a state file without a section loads it empty (closes #267)

Load fills in each of domains, hostnames, ports and certificates that
the file leaves out or holds as null with an empty map. Before, such a
section loaded as a nil map, and the first check's write into it
panicked, so a state file holding {} stopped the watcher at every
start.

The test loads {} and a file missing each section in turn, then saves
an entry in every section as the first check does; it does not run a
check, which would look names up in live DNS.

Model: opus-5-5

README.md

@@ -78,9 +78,8 @@ notification endpoint set, changes show only on the dashboard; see
   answer NXDOMAIN, that it does not exist, has no nameservers and is shown as
   not existing (see Web Dashboard and HTTP API). A domain that exists but has no
   delegation of its own, such as `octocat.github.io`, has no nameservers either.
-  When the parent zone's servers do not answer, or the lookup of the domain's
-  own records (below) fails, the check fails and the set from the previous check
-  is kept.
+  When the parent zone's servers do not answer, the check fails and the set from
+  the previous check is kept.
 - Any change triggers a notification:
     - NS added to or removed from that set. A domain that had nameservers on the
       previous check and no longer exists gets one with all of them removed.
@@ -100,16 +99,11 @@ notification endpoint set, changes show only on the dashboard; see
   records, stored per nameserver. Their changes are notified as a hostname's
   are, as a record change, NS query failure, NS recovery, inconsistency or CNAME
   address change, in a message that starts `Domain:` where a hostname's starts
-  `Hostname:`. A nameserver removed from the domain's delegation gets only the
-  NS change notification above. A domain listed in
-  `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no record change or inconsistency
-  notification. A domain with no delegation of its own has these records asked
-  at the servers of the zone it is in, as a hostname has. A nameserver the
-  domain's records were asked at on the previous check but not on this one gets
-  a hostname's NS change notification (see below), unless it was in the domain's
-  delegation on the previous check, as when that delegation is withdrawn. A
-  domain that does not exist has none: they are not asked for, and those saved
-  by an earlier check are removed without a notification.
+  `Hostname:`. A domain listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no
+  record change or inconsistency notification. A domain with no delegation of
+  its own has these records asked at the servers of the zone it is in, as a
+  hostname has. A domain that does not exist has none: they are not asked for,
+  and those saved by an earlier check are removed without a notification.
 
 ### DNS Hostname Monitoring (Subdomains)
 
@@ -162,10 +156,6 @@ notification endpoint set, changes show only on the dashboard; see
     - **NS recovery**: A previously-unreachable nameserver starts responding
       again. Its records are not compared with those from before it failed, so a
       change made while it was failing is not reported as a record change.
-    - **NS change**: A nameserver of the zone the hostname is in on the previous
-      check is not one now, whether or not it answered. One notification lists
-      every such nameserver on a `Removed:` line. Nothing is sent for a
-      nameserver that joins the zone.
     - **Inconsistency detected**: Two nameservers return different record sets
       for the same hostname and did not already differ on the previous check.
       Every pair of nameservers is compared. The alert is sent once for each
@@ -247,9 +237,7 @@ includes:
 
 - **DNS record changes**: Which hostname or domain, which nameserver, what
   record type, old values, new values.
-- **DNS NS changes**: Which domain, which nameservers were added to or removed
-  from its delegation. For a hostname, or a domain with no delegation of its
-  own, which nameservers left the zone it is in.
+- **DNS NS changes**: Which domain, which nameservers were added/removed.
 - **NS address changes**: Which domain, which nameserver, its old and new
   addresses.
 - **CNAME address changes**: Which hostname or domain, the old and new addresses
@@ -449,7 +437,7 @@ following precedence (highest to lowest):
 | `DNSWATCHER_SENTRY_DSN`                | Sentry DSN for error reporting                                                                                                        | `""`                  |
 | `DNSWATCHER_MAINTENANCE_MODE`          | Only sets `maintenanceMode` in the health check response; changes nothing else                                                        | `false`               |
 | `DNSWATCHER_METRICS_USERNAME`          | Basic auth username for /metrics, which is served only when this is set                                                               | `""`                  |
-| `DNSWATCHER_METRICS_PASSWORD`          | Basic auth password for /metrics; required when `DNSWATCHER_METRICS_USERNAME` is set, and startup stops without it                    | `""`                  |
+| `DNSWATCHER_METRICS_PASSWORD`          | Basic auth password for /metrics                                                                                                      | `""`                  |
 | `DNSWATCHER_SEND_TEST_NOTIFICATION`    | Send a test notification after first scan completes                                                                                   | `false`               |
 
 **`DNSWATCHER_TARGETS` is required.** dnswatcher will refuse to start if no

TODO.md

@@ -21,12 +21,6 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 - 2026-10-13: a state file holding `{}`, or leaving out a section, loads with
   that section empty; the first check no longer crashes on it (closes #267).
-- 2026-10-13: a stop before the first scan completes sends no startup
-  notification; a scan that ran to the end still sends it (closes #271).
-- 2026-10-13: a nameserver leaving a domain's delegation sends only NS Change;
-  one leaving a hostname's zone sends NS Change, not NS Failure (closes #262).
-- 2026-10-13: `DNSWATCHER_METRICS_USERNAME` set without
-  `DNSWATCHER_METRICS_PASSWORD` stops startup (closes #268).
 - 2026-10-13: a save syncs the state file to disk before renaming it into place,
   so a crash cannot leave it empty and stop the next start (closes #264).
 - 2026-10-13: a `PORT` that cannot be bound stops startup with an error naming

internal/config/config.go

@@ -61,13 +61,6 @@ var ErrInvalidTLSExpiryWarning = errors.New(
 // unset and means the default.
 var ErrInvalidBool = errors.New("value must be true or false")
 
-// ErrNoMetricsPassword is returned when DNSWATCHER_METRICS_USERNAME is set and
-// DNSWATCHER_METRICS_PASSWORD is empty. Basic Auth on /metrics would otherwise
-// let in anyone who sends the username with an empty password.
-var ErrNoMetricsPassword = errors.New(
-	"DNSWATCHER_METRICS_PASSWORD must be set when DNSWATCHER_METRICS_USERNAME is set",
-)
-
 // Params contains dependencies for Config.
 type Params struct {
 	fx.In
@@ -115,10 +108,6 @@ func New(_ fx.Lifecycle, params Params) (*Config, error) {
 		return nil, err
 	}
 
-	if cfg.MetricsUsername != "" && cfg.MetricsPassword == "" {
-		return nil, ErrNoMetricsPassword
-	}
-
 	configureDebugLogging(cfg, params)
 
 	return cfg, nil

internal/config/config_test.go

@@ -354,24 +354,6 @@ func TestNew_SkipRecordNotificationsNotInTargetsStopsStartup(t *testing.T) {
 	require.ErrorContains(t, err, `"www.example.net"`)
 }
 
-// TestNew_MetricsUsernameWithoutPasswordStopsStartup checks an unset and an
-// empty password; TestNew_EnvironmentOverrides checks a username with one.
-func TestNew_MetricsUsernameWithoutPasswordStopsStartup(t *testing.T) {
-	viper.Reset()
-	t.Setenv("DNSWATCHER_TARGETS", "example.com")
-	t.Setenv("DNSWATCHER_METRICS_USERNAME", "prom")
-
-	_, err := config.New(nil, newTestParams(t))
-	require.ErrorIs(t, err, config.ErrNoMetricsPassword, "password unset")
-	require.ErrorContains(t, err, "DNSWATCHER_METRICS_PASSWORD")
-
-	viper.Reset()
-	t.Setenv("DNSWATCHER_METRICS_PASSWORD", "")
-
-	_, err = config.New(nil, newTestParams(t))
-	require.ErrorIs(t, err, config.ErrNoMetricsPassword, "password empty")
-}
-
 func TestNew_CustomDNSIntervalDuration(t *testing.T) {
 	viper.Reset()
 	t.Setenv("DNSWATCHER_TARGETS", "example.com")

internal/state/state_test.go

@@ -696,9 +696,9 @@ func TestLoadMissingFile(t *testing.T) {
 }
 
 // TestLoadFileWithoutSections loads a state file holding {}, and files
-// that each leave out one section. Every section loads as an empty map.
-// TestFirstCheckAfterLoadingFileWithoutSections in the watcher tests
-// runs the first check after such a load.
+// that each leave out one section. Every section loads as an empty map,
+// and the first check can then save an entry in each; a section loaded
+// as nil makes that panic.
 func TestLoadFileWithoutSections(t *testing.T) {
 	t.Parallel()
 
@@ -741,7 +741,20 @@ func TestLoadFileWithoutSections(t *testing.T) {
 			}
 
 			if got := s.GetSnapshot(); !reflect.DeepEqual(got, want) {
-				t.Errorf("loaded %#v, want %#v", got, want)
+				t.Fatalf("loaded %#v, want %#v", got, want)
+			}
+
+			s.SetDomainState("example.com", &state.DomainState{})
+			s.SetHostnameState(testHostname, &state.HostnameState{})
+			s.SetPortState(testIP+":443", &state.PortState{})
+			s.SetCertificateState(
+				testIP+":443:"+testHostname, &state.CertificateState{},
+			)
+
+			snap := s.GetSnapshot()
+			if len(snap.Domains) != 1 || len(snap.Hostnames) != 1 ||
+				len(snap.Ports) != 1 || len(snap.Certificates) != 1 {
+				t.Errorf("saved one entry in each section, got %#v", snap)
 			}
 		})
 	}

internal/watcher/cancelled_test.go

@@ -83,30 +83,6 @@ func TestCancelledCheckSavesNothing(t *testing.T) {
 	}
 }
 
-// TestStopBeforeFirstScanSendsNoStartupNotification runs a watcher with
-// the startup notification on and its context already cancelled, so the
-// first scan is cut short before its lookup is sent. The scan did not
-// complete, so no startup notification may be sent.
-func TestStopBeforeFirstScanSendsNoStartupNotification(t *testing.T) {
-	t.Parallel()
-
-	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{testHost}
-	cfg.SendTestNotification = true
-
-	w, deps := newTestWatcher(t, cfg)
-
-	ctx, cancel := context.WithCancel(t.Context())
-	cancel()
-
-	w.Run(ctx)
-
-	notifications := deps.notifier.getNotifications()
-	if len(notifications) != 0 {
-		t.Errorf("sent %v, want no notifications", notifications)
-	}
-}
-
 // newLoggingWatcher returns a watcher for a domain and a hostname, with
 // the real resolver, that writes what it logs at warning level or above
 // into the returned buffer.

internal/watcher/message_test.go

@@ -5,6 +5,7 @@ import (
 	"strings"
 	"testing"
 
+	"sneak.berlin/go/dnswatcher/internal/config"
 	"sneak.berlin/go/dnswatcher/internal/state"
 	"sneak.berlin/go/dnswatcher/internal/watcher"
 )
@@ -73,19 +74,21 @@ b.ns.example.net.: 192.0.2.2`,
 func TestDomainRecordNotificationsNameTheDomain(t *testing.T) {
 	t.Parallel()
 
-	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{domain}
-
-	deps := newTestDeps(t, cfg)
-	w := watcher.NewForTest(cfg, deps.state, nil, nil, nil, deps.notifier)
+	notifier := &mockNotifier{}
+	w := watcher.NewForTest(
+		&config.Config{Domains: []string{domain}},
+		nil, nil, nil, nil, notifier,
+	)
 
 	// nsA's address changes, which also makes it differ from nsC; nsB
-	// fails; nsC answers again.
+	// fails; nsC answers again; nsD is gone.
+	nsD := "d.ns.example.net."
 	w.DetectHostnameChanges(t.Context(), domain,
 		saved(map[string]*state.NameserverRecordState{
 			nsA: answered(map[string][]string{"A": {ip1}}),
 			nsB: answered(map[string][]string{"A": {ip1}}),
 			nsC: failed(),
+			nsD: answered(map[string][]string{"A": {ip1}}),
 		}),
 		saved(map[string]*state.NameserverRecordState{
 			nsA: answered(map[string][]string{"A": {ip2}}),
@@ -99,17 +102,18 @@ func TestDomainRecordNotificationsNameTheDomain(t *testing.T) {
 		t.Context(), domain, cnameState(ip1), cnameState(ip2),
 	)
 
+	// NS Failure is sent for nsB failing and for nsD being gone.
 	want := map[string]int{
 		"Record Change":        1,
 		"Inconsistency":        1,
-		"NS Failure":           1,
+		"NS Failure":           2,
 		"NS Recovery":          1,
 		"CNAME Address Change": 1,
 	}
 
 	sent := make(map[string]int)
 
-	for _, n := range deps.notifier.getNotifications() {
+	for _, n := range notifier.getNotifications() {
 		kind, _, _ := strings.Cut(n.Title, ":")
 		sent[kind]++
 
@@ -124,89 +128,6 @@ func TestDomainRecordNotificationsNameTheDomain(t *testing.T) {
 	}
 }
 
-// nsB, which answered, and nsC, which did not, are no longer among the
-// nameservers. One NS Change lists both, for the hostname and for the
-// configured apex domain with no delegation of its own. Nothing is sent
-// for the domain whose delegation on the previous check listed them:
-// the check of its delegation sends its NS Change.
-func TestRemovedNameserversAreAnNSChange(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name   string
-		target string
-		// The domain's nameservers saved by the previous check.
-		delegation []string
-		// The NS Change sent, or "" for none.
-		want string
-	}{
-		{
-			name:   "hostname",
-			target: host,
-			want: `Hostname: www.example.net
-Removed: b.ns.example.net., c.ns.example.net.`,
-		},
-		{
-			name:       "domain with no delegation of its own",
-			target:     domain,
-			delegation: []string{},
-			want: `Domain: example.net
-Removed: b.ns.example.net., c.ns.example.net.`,
-		},
-		{
-			name:       "domain whose delegation listed them",
-			target:     domain,
-			delegation: []string{nsA, nsB, nsC},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			cfg := defaultTestConfig(t)
-			cfg.Domains = []string{domain}
-
-			deps := newTestDeps(t, cfg)
-			w := watcher.NewForTest(
-				cfg, deps.state, nil, nil, nil, deps.notifier,
-			)
-
-			deps.state.SetDomainState(domain, &state.DomainState{
-				Nameservers: tt.delegation,
-			})
-
-			prev := saved(map[string]*state.NameserverRecordState{
-				nsA: answered(map[string][]string{"A": {ip1}}),
-				nsB: answered(map[string][]string{"A": {ip1}}),
-				nsC: failed(),
-			})
-			current := saved(map[string]*state.NameserverRecordState{
-				nsA: answered(map[string][]string{"A": {ip1}}),
-			})
-
-			w.DetectHostnameChanges(t.Context(), tt.target, prev, current)
-
-			got := deps.notifier.getNotifications()
-
-			if tt.want == "" {
-				if len(got) != 0 {
-					t.Errorf("sent %v, want nothing", got)
-				}
-
-				return
-			}
-
-			title := "NS Change: " + tt.target
-			if len(got) != 1 || got[0].Title != title ||
-				got[0].Message != tt.want {
-				t.Errorf("sent %v, want one %q with message:\n%s",
-					got, title, tt.want)
-			}
-		})
-	}
-}
-
 // The startup notification counts the configured domains and hostnames,
 // although the state's hostnames also hold the apex domain's own
 // records. Nothing is looked up: the watcher has no resolver.

internal/watcher/watcher.go

@@ -133,12 +133,7 @@ func (w *Watcher) Run(ctx context.Context) {
 
 	w.cleanupRemovedTargets()
 	w.RunOnce(ctx)
-
-	// RunOnce returns as usual when shutdown cuts the scan short, and
-	// the startup notification says the scan completed.
-	if ctx.Err() == nil {
-		w.maybeSendTestNotification(ctx)
-	}
+	w.maybeSendTestNotification(ctx)
 
 	dnsTicker := time.NewTicker(w.config.DNSInterval)
 	tlsTicker := time.NewTicker(w.config.TLSInterval)
@@ -327,20 +322,6 @@ func (w *Watcher) checkDomain(
 		ctx, nameservers, prevAddresses,
 	)
 
-	// A domain that does not exist has no records of its own: none are
-	// asked for, and those saved by an earlier check are removed.
-	// Otherwise the apex domain's records are also checked and saved as
-	// a hostname's, so that the port and TLS checks find its addresses.
-	// Notifications about them name it as a domain (see nameLine). When
-	// their lookup fails, the check fails as when the NS lookup does, so
-	// the saved delegation and the saved records come from the same
-	// check, as detectNSDisappearances needs.
-	if nxdomain {
-		w.state.DeleteHostnameState(domain)
-	} else if !w.checkHostname(ctx, domain) {
-		return
-	}
-
 	if hasPrev && !w.firstRun {
 		w.detectNSChanges(ctx, domain, prev.Nameservers, nameservers)
 		w.detectNSAddressChanges(ctx, domain, prevAddresses, addresses)
@@ -352,6 +333,19 @@ func (w *Watcher) checkDomain(
 		NXDomain:            nxdomain,
 		LastChecked:         now,
 	})
+
+	// A domain that does not exist has no records of its own: none are
+	// asked for, and those saved by an earlier check are removed.
+	if nxdomain {
+		w.state.DeleteHostnameState(domain)
+
+		return
+	}
+
+	// The apex domain's records are also checked and saved as a
+	// hostname's, so that the port and TLS checks find its addresses.
+	// Notifications about them name it as a domain (see nameLine).
+	w.checkHostname(ctx, domain)
 }
 
 func (w *Watcher) detectNSChanges(
@@ -462,12 +456,10 @@ func (w *Watcher) detectNSAddressChanges(
 	}
 }
 
-// checkHostname checks hostname's records and reports whether it saved
-// them; it does not when their lookup fails.
 func (w *Watcher) checkHostname(
 	ctx context.Context,
 	hostname string,
-) bool {
+) {
 	results, err := w.resolver.LookupAllRecords(ctx, hostname)
 	if err != nil {
 		w.logFailedLookup(
@@ -477,7 +469,7 @@ func (w *Watcher) checkHostname(
 			"error", err,
 		)
 
-		return false
+		return
 	}
 
 	prev, _ := w.state.GetHostnameState(hostname)
@@ -485,8 +477,6 @@ func (w *Watcher) checkHostname(
 	w.updateHostnameState(
 		ctx, hostname, buildHostnameState(results, prev, time.Now().UTC()),
 	)
-
-	return true
 }
 
 // updateHostnameState finishes a check of hostname from newState, built
@@ -782,53 +772,28 @@ func (w *Watcher) detectRecordChanges(
 	}
 }
 
-// detectNSDisappearances sends one NS Change listing the nameservers of
-// the previous check that are no longer those of the zone hostname is
-// in. For a configured apex domain it leaves out those of the domain's
-// saved delegation, which detectNSChanges notifies when they are removed
-// from it. checkDomain saves a new delegation only after this runs, and
-// only together with the records, so the saved delegation and the
-// records in prev come from the same check.
 func (w *Watcher) detectNSDisappearances(
 	ctx context.Context,
 	hostname string,
 	prev, current *state.HostnameState,
 ) {
-	var delegation []string
-
-	if w.isDomain(hostname) {
-		if domainState, ok := w.state.GetDomainState(hostname); ok {
-			delegation = domainState.Nameservers
+	for ns, prevNS := range prev.RecordsByNameserver {
+		if _, ok := current.RecordsByNameserver[ns]; ok || prevNS.Status != statusOK {
+			continue
 		}
+
+		msg := fmt.Sprintf(
+			"%s\nNameserver: %s disappeared",
+			w.nameLine(hostname), ns,
+		)
+
+		w.notify.SendNotification(
+			ctx,
+			"NS Failure: "+hostname,
+			msg,
+			"error",
+		)
 	}
-
-	var removed []string
-
-	for ns := range prev.RecordsByNameserver {
-		_, ok := current.RecordsByNameserver[ns]
-		if !ok && !slices.Contains(delegation, ns) {
-			removed = append(removed, ns)
-		}
-	}
-
-	if len(removed) == 0 {
-		return
-	}
-
-	slices.Sort(removed)
-
-	msg := fmt.Sprintf(
-		"%s\nRemoved: %s",
-		w.nameLine(hostname),
-		strings.Join(removed, ", "),
-	)
-
-	w.notify.SendNotification(
-		ctx,
-		"NS Change: "+hostname,
-		msg,
-		"warning",
-	)
 }
 
 // detectNSFailures notifies when a nameserver that answered on the

internal/watcher/watcher_test.go

@@ -139,22 +139,6 @@ func (m *mockNotifier) getNotifications() []notification {
 	return result
 }
 
-// cancelOnNotify is a mockNotifier that calls cancel at each
-// notification, as if shutdown cut the check short there.
-type cancelOnNotify struct {
-	*mockNotifier
-
-	cancel context.CancelFunc
-}
-
-func (n cancelOnNotify) SendNotification(
-	ctx context.Context,
-	title, message, priority string,
-) {
-	n.mockNotifier.SendNotification(ctx, title, message, priority)
-	n.cancel()
-}
-
 // --- Helpers to build a Watcher and run its checks against live DNS ---
 
 type testDeps struct {
@@ -477,54 +461,6 @@ func TestDomainPortAndTLSChecks(t *testing.T) {
 	}
 }
 
-// TestFirstCheckAfterLoadingFileWithoutSections loads a state file
-// holding {}, and one that leaves out the certificates section, and runs
-// the first check. It saves domain, hostname, port and certificate
-// entries; a section loaded as nil made it panic.
-func TestFirstCheckAfterLoadingFileWithoutSections(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name string
-		file string
-	}{
-		{"no sections", `{}`},
-		{"no certificates", `{"domains": {}, "hostnames": {}, "ports": {}}`},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			cfg := defaultTestConfig(t)
-			cfg.Domains = []string{testSmallDomain}
-
-			_, deps := runChecks(t, cfg, func(deps *testDeps) {
-				err := os.WriteFile(cfg.StatePath(), []byte(tt.file), 0o600)
-				if err != nil {
-					t.Fatalf("writing the state file: %v", err)
-				}
-
-				err = deps.state.Load()
-				if err != nil {
-					t.Fatalf("loading the state file: %v", err)
-				}
-			})
-
-			snap := deps.state.GetSnapshot()
-			if len(snap.Domains) == 0 || len(snap.Hostnames) == 0 ||
-				len(snap.Ports) == 0 || len(snap.Certificates) == 0 {
-				t.Errorf(
-					"saved %d domain, %d hostname, %d port and %d "+
-						"certificate entries, want at least one of each",
-					len(snap.Domains), len(snap.Hostnames),
-					len(snap.Ports), len(snap.Certificates),
-				)
-			}
-		})
-	}
-}
-
 func TestNSChangeDetection(t *testing.T) {
 	t.Parallel()
 
@@ -622,11 +558,6 @@ func TestDomainThatDoesNotExist(t *testing.T) {
 // nameservers and without nxdomain, and its records, asked at the
 // codeberg.page servers, are saved. Those are testSmallDomain's two
 // nameservers; github.io, the zone of the README's example, has eight.
-// The previous check saved a delegation to oldNS1, now withdrawn, and
-// records asked at oldNS1. A first check is cut short at its first
-// notification, as shutdown would, and a second runs in full: across
-// them the NS Change of its delegation removes oldNS1, and no other NS
-// Change lists it again.
 func TestDomainWithNoDelegationOfItsOwn(t *testing.T) {
 	t.Parallel()
 
@@ -638,30 +569,9 @@ func TestDomainWithNoDelegationOfItsOwn(t *testing.T) {
 	var deps *testDeps
 
 	livednstest.Retry(t, "watcher checks", func(ctx context.Context) error {
-		deps = newTestDeps(t, cfg)
+		var w *watcher.Watcher
 
-		firstCtx, cancel := context.WithCancel(ctx)
-		defer cancel()
-
-		w := watcher.NewForTest(
-			cfg,
-			deps.state,
-			resolver.NewFromLogger(slog.Default()),
-			deps.portChecker,
-			deps.tlsChecker,
-			cancelOnNotify{mockNotifier: deps.notifier, cancel: cancel},
-		)
-
-		deps.state.SetDomainState(domain, &state.DomainState{
-			Nameservers: []string{oldNS1},
-		})
-		deps.state.SetHostnameState(domain, saved(
-			map[string]*state.NameserverRecordState{
-				oldNS1: answered(map[string][]string{"A": {oldIP}}),
-			},
-		))
-
-		w.RunOnce(firstCtx)
+		w, deps = newTestWatcher(t, cfg)
 
 		err := checkOnce(ctx, w, deps)
 
@@ -683,22 +593,6 @@ func TestDomainWithNoDelegationOfItsOwn(t *testing.T) {
 	if _, ok := deps.state.GetHostnameState(domain); !ok {
 		t.Errorf("no records saved for %s", domain)
 	}
-
-	title := "NS Change: " + domain
-	want := "Domain: " + domain + "\nAdded: \nRemoved: " + oldNS1
-
-	var changes []notification
-
-	for _, n := range deps.notifier.getNotifications() {
-		if n.Title == title {
-			changes = append(changes, n)
-		}
-	}
-
-	if len(changes) != 1 || changes[0].Message != want {
-		t.Errorf("sent %v, want one %q with message:\n%s",
-			changes, title, want)
-	}
 }
 
 func TestNSAddressChangeDetection(t *testing.T) {
@@ -1155,7 +1049,7 @@ func TestSendTestNotification_Disabled(t *testing.T) {
 	}
 }
 
-func TestNSChangeAndRecovery(t *testing.T) {
+func TestNSFailureAndRecovery(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
@@ -1165,7 +1059,7 @@ func TestNSChangeAndRecovery(t *testing.T) {
 
 	// The saved state has every nameserver live DNS lists as one that
 	// did not answer, and, as answering, one that live DNS does not
-	// list, which the check then finds removed.
+	// list, which then disappears.
 	_, deps := runChecks(t, cfg, func(deps *testDeps) {
 		byNameserver := map[string]*state.NameserverRecordState{
 			oldNS1: answered(map[string][]string{"A": {oldIP}}),
@@ -1177,7 +1071,7 @@ func TestNSChangeAndRecovery(t *testing.T) {
 		deps.state.SetHostnameState(testHost, saved(byNameserver))
 	})
 
-	assertNotified(t, deps, "NS Change: "+testHost, "warning")
+	assertNotified(t, deps, "NS Failure: "+testHost, "error")
 	assertNotified(t, deps, "NS Recovery: "+testHost, "success")
 
 	// A nameserver that did not answer has no records to compare, so