resolver, watcher: a domain's nameservers are only its own delegation (closes #222)

When a domain's parent zone's servers answer NXDOMAIN, LookupNS returns
ErrNXDomain. The watcher then saves the domain with no nameservers and
nxdomain set, shown on the dashboard and in /api/v1/status, asks for none
of its records and removes those saved, so its old nameservers go in one
NS Change. A domain with no delegation of its own gets an empty set and
its records are still asked at the zone it is in.
FindAuthoritativeNameservers moves to a parent name only on one of those
two answers; when the servers do not answer, it returns the error. After
an upgrade, a domain without its own delegation that was saved with its
parent zone's nameservers gets one NS Change; the README says so.

Model: opus-5-5

TODO.md

@@ -21,8 +21,6 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 - 2026-10-02: a domain that does not exist is shown so, with no nameservers; no
   name gets a parent's nameservers when its own did not answer (closes #222).
-- 2026-10-02: the refused-query test sends one query to four operators' public
-  resolvers in turn until one replies, not eight to one operator (closes #251).
 - 2026-10-02: a name removed from `DNSWATCHER_TARGETS` leaves the state, and so
   the dashboard and API, at startup, before the first check (closes #223).
 - 2026-10-02: a record type whose query to a nameserver fails keeps its previous

internal/resolver/resolver_test.go

@@ -490,45 +490,48 @@ func TestQueryNameserver_Refused(t *testing.T) {
 	assert.Equal(t, "server returned REFUSED", resp.Error)
 }
 
-// TestQueryServers_RecursiveResolverRefused passes a public recursive
-// resolver to QueryServers as the server of google.com. These resolvers
-// refuse a query that does not ask for recursion and answer one that
-// does. The resolver never asks for recursion, so the query must be
-// reported as refused, never answered. Each resolver is run by a
-// different operator, and they are asked in turn until one replies, so
-// one operator not answering does not fail the test.
-func TestQueryServers_RecursiveResolverRefused(t *testing.T) {
+// TestQueryNameserverIP_RecursiveResolverRefused asks Quad9, a public
+// recursive resolver, about google.com at both of its addresses. Quad9
+// refuses a query that does not ask for recursion and answers one that
+// does. The resolver never asks for recursion, so it must be reported
+// as refusing, never as answering.
+func TestQueryNameserverIP_RecursiveResolverRefused(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	resolvers := []string{
-		"64.6.64.6", "185.222.222.222", "4.2.2.1", "9.9.9.9",
-	}
 
-	var err error
+	for _, ip := range []string{"9.9.9.9", "149.112.112.112"} {
+		var resp *resolver.NameserverResponse
 
 		livednstest.Retry(
 			t,
-		"QueryServers(public recursive resolvers, google.com)",
+			"QueryNameserverIP("+ip+", google.com)",
 			func(ctx context.Context) error {
-			for _, ip := range resolvers {
-				_, err = r.QueryServers(
-					ctx, []string{ip}, "google.com.", "google.com.",
-					dns.TypeA,
+				var err error
+
+				resp, err = r.QueryNameserverIP(
+					ctx, ip, ip, "google.com",
 				)
+				if err != nil {
+					return err
+				}
+
+				// A timeout or a network error is no reply at all.
+				if resp.Status == resolver.StatusTimeout ||
+					strings.HasPrefix(resp.Error, "network error") {
+					return fmt.Errorf(
+						"%w: %s: %s",
+						livednstest.ErrNoAnswer, ip, resp.Error,
+					)
+				}
 
-				// A refusal or an answer is a reply; anything else may
-				// be no reply at all, so the next resolver is asked.
-				if err == nil || errors.Is(err, resolver.ErrRefused) {
 				return nil
-				}
-			}
-
-			return fmt.Errorf("%w: %w", livednstest.ErrNoAnswer, err)
 			},
 		)
 
-	require.ErrorIs(t, err, resolver.ErrRefused)
+		assert.Equal(t, resolver.StatusError, resp.Status, ip)
+		assert.Equal(t, "server returned REFUSED", resp.Error, ip)
+	}
 }
 
 // googleNameserverIPv4s returns the IPv4 addresses of google.com's

internal/watcher/watcher_test.go

@@ -551,50 +551,6 @@ func TestDomainThatDoesNotExist(t *testing.T) {
 	}
 }
 
-// TestDomainWithNoDelegationOfItsOwn checks a domain with no delegation
-// of its own: codeberg.page is on the public suffix list, so
-// docs.codeberg.page is a domain, but the .page servers delegate only
-// codeberg.page, whose servers answer for it. It is saved with no
-// nameservers and without nxdomain, and its records, asked at the
-// codeberg.page servers, are saved. Those are testSmallDomain's two
-// nameservers; github.io, the zone of the README's example, has eight.
-func TestDomainWithNoDelegationOfItsOwn(t *testing.T) {
-	t.Parallel()
-
-	const domain = "docs.codeberg.page"
-
-	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{domain}
-
-	var deps *testDeps
-
-	livednstest.Retry(t, "watcher checks", func(ctx context.Context) error {
-		var w *watcher.Watcher
-
-		w, deps = newTestWatcher(t, cfg)
-
-		err := checkOnce(ctx, w, deps)
-
-		// A domain saved as not existing has no records to wait for;
-		// the checks below fail on it.
-		if ds, ok := deps.state.GetDomainState(domain); ok && ds.NXDomain {
-			return nil
-		}
-
-		return err
-	})
-
-	ds, _ := deps.state.GetDomainState(domain)
-	if ds.NXDomain || len(ds.Nameservers) != 0 {
-		t.Errorf("saved nxdomain %v and nameservers %v, want false and none",
-			ds.NXDomain, ds.Nameservers)
-	}
-
-	if _, ok := deps.state.GetHostnameState(domain); !ok {
-		t.Errorf("no records saved for %s", domain)
-	}
-}
-
 func TestNSAddressChangeDetection(t *testing.T) {
 	t.Parallel()