watcher: follow a watched name's CNAME for port and TLS checks (closes #203)

When a watched name's nameservers answer with a CNAME and no address,
the DNS check asks ResolveIPAddresses for the name, which looks it up
again and follows the chain, and saves the addresses at its end in the
hostname state as cnameAddresses. The port and TLS checks use them.
Before, a CNAME into another zone got no port or TLS checks. A change
in those addresses is notified as a CNAME address change. When
following fails, or none of the name's nameservers answered, the
addresses the last check saved are kept. The domain check now runs the
hostname check for the apex instead of a copy of it.

Model: opus-5-5

README.md

@@ -12,7 +12,7 @@ dnswatcher watches configured DNS domains and hostnames for changes, monitors
 TCP port availability, tracks TLS certificate expiry, and delivers real-time
 notifications via Slack, Mattermost, and/or ntfy webhooks.
 
-It resolves the names it watches itself via iterative (non-recursive) queries,
+It performs all DNS resolution itself via iterative (non-recursive) queries,
 tracing from root nameservers to authoritative servers directly—never relying on
 upstream recursive resolvers.
 
@@ -69,14 +69,14 @@ notification endpoint set, changes show only on the dashboard; see
 
 - Accepts a list of DNS domain names (apex domains, identified via the
   [Public Suffix List](https://publicsuffix.org/)).
-- Every **1 hour** by default, performs a full iterative trace from root servers
-  to discover all authoritative nameservers (NS records) for each domain.
+- Every **1 hour**, performs a full iterative trace from root servers to
+  discover all authoritative nameservers (NS records) for each domain.
 - Queries **every** discovered authoritative nameserver independently.
-- Stores the domain's NS record set, as its parent zone's servers delegate it,
-  and the IPv4 and IPv6 addresses each nameserver's name resolves to.
+- Stores the NS record set as observed by the delegation chain, and the IPv4 and
+  IPv6 addresses each nameserver's name resolves to.
 - Any change triggers a notification:
-    - NS added to or removed from that set.
-    - NS address change: a nameserver that stays in the set resolves to
+    - NS added to or removed from the delegation.
+    - NS address change: a nameserver that stays in the delegation resolves to
       different addresses than on the previous check. A nameserver added or
       removed gets only the NS change notification. When the lookup of a
       nameserver's addresses fails or finds none, its previous addresses are
@@ -86,7 +86,7 @@ notification endpoint set, changes show only on the dashboard; see
 
 - Accepts a list of DNS hostnames (subdomains, distinguished from apex domains
   via the Public Suffix List).
-- Every **1 hour** by default, performs a full iterative trace to discover the
+- Every **1 hour**, performs a full iterative trace to discover the
   authoritative nameservers of the zone the hostname is in, which is not always
   its last two labels (a name under `co.uk`, or in a delegated subdomain).
 - Queries **each** authoritative nameserver independently for **all** record
@@ -121,15 +121,12 @@ notification endpoint set, changes show only on the dashboard; see
       failed on it, and answers differently is reported on the check where it
       answers. If a pair agrees again and later disagrees, the alert is sent
       again.
-    - **CNAME address change**: The addresses at the end of a name's CNAME chain
-      differ from those of the previous check. They are found when its
-      nameservers answer with a CNAME and no address; a name that answers with
-      an address has none. A change from or to no addresses is sent too, as when
-      a name moves between A records and a CNAME. Nothing is sent when the
-      previous addresses were kept because the chain could not be followed or
-      none of the name's nameservers answered. The first check after loading a
-      state file without `cnameAddresses` sends nothing: it saves the addresses
-      it finds for the next check to compare.
+    - **CNAME address change**: For a name whose nameservers answer with a CNAME
+      and no address, the addresses at the end of its CNAME chain differ from
+      those of the previous check, including when there are none now. Nothing is
+      sent when the previous check saved none, or when the previous addresses
+      were kept because the chain could not be followed or none of the name's
+      nameservers answered.
 
 ### TCP Port Monitoring
 
@@ -141,11 +138,10 @@ notification endpoint set, changes show only on the dashboard; see
   none of the name's nameservers answered, the addresses the last check found at
   its end are used.
 - Checks TCP connectivity on ports **80** and **443** for each IP address.
-- Every **1 hour** by default, re-checks all ports.
+- Every **1 hour**, re-checks all ports.
 - Any change in port availability triggers a notification:
     - Port transitioned from open to closed (or vice versa).
-    - New IP appeared (from DNS change): its port state is recorded without a
-      port notification; the DNS change notification shows the new address.
+    - New IP appeared (from DNS change) and its port state was recorded.
     - IP disappeared (from DNS change) — noted in the DNS change notification;
       port state for that IP is removed. When none of a name's nameservers
       answered, its addresses are not known, so the port state saved for them is
@@ -153,14 +149,14 @@ notification endpoint set, changes show only on the dashboard; see
 
 ### TLS Certificate Monitoring
 
-- Every **12 hours** by default, for each IP address listening on port 443,
-  connects via TLS using the correct SNI hostname.
+- Every **12 hours**, for each IP address listening on port 443, connects via
+  TLS using the correct SNI hostname.
 - Records the certificate's Subject CN, SANs, issuer, and expiry date.
 - Any change triggers a notification:
-    - Certificate is expiring within **7 days** by default (warning, repeated
-      each check until renewed or expired).
+    - Certificate is expiring within **7 days** (warning, repeated each check
+      until renewed or expired).
     - Certificate CN, issuer, or SANs changed (replacement detected, reports old
-      and new CN and issuer).
+      and new values).
     - TLS connection failure to a previously-reachable IP:443 (handshake error,
       timeout, connection refused after previously succeeding).
     - TLS recovery: a previously-failing IP:443 now completes a handshake again.
@@ -194,25 +190,15 @@ includes:
 - **NS recoveries**: Which nameserver recovered, which hostname/domain.
 - **NS inconsistencies**: Which nameservers disagree, what each one returned,
   which hostname affected.
-- **Port changes**: Which IP:port, its new state, all associated hostnames.
-- **TLS expiry warnings**: Expiry date and days remaining, CN, associated
-  hostname and IP.
-- **TLS certificate changes**: Old and new CN and issuer, associated hostname
-  and IP. A change to the SANs alone is notified, but the SANs are not listed.
+- **Port changes**: Which IP:port, old state, new state, all associated
+  hostnames.
+- **TLS expiry warnings**: Which certificate, days remaining, CN, issuer,
+  associated hostname and IP.
+- **TLS certificate changes**: Old and new CN/issuer/SANs, associated hostname
+  and IP.
 - **TLS connection failures/recoveries**: Which IP:port, error details,
   associated hostname.
 
-Each endpoint is sent each notification on its own, in the background. A
-delivery that fails (a network error, no reply within 10 seconds, or an HTTP
-status of 400 or more) is retried up to 5 times: the first retry after about 1
-second, each wait after that twice as long up to 60 seconds, every wait varied
-at random by up to 25%. A delivery still failing after that is logged and
-dropped.
-
-The last 100 notifications, delivered or not, are kept in memory for the
-dashboard's Recent alerts. They are not saved to the state file, so a restart
-clears them.
-
 ### State Management
 
 - All monitoring state is kept in memory and persisted to a JSON file on disk
@@ -256,16 +242,7 @@ dnswatcher exposes a lightweight HTTP API for operational visibility:
 | `GET /.well-known/healthcheck` | Health check (JSON)           |
 | `GET /health`                  | Health check (JSON, legacy)   |
 | `GET /api/v1/status`           | Current monitoring state      |
-| `GET /metrics`                 | Prometheus metrics, see below |
-
-`/metrics` is served only when `DNSWATCHER_METRICS_USERNAME` is set, behind
-Basic Auth. It has the Prometheus Go client's default metrics only (Go runtime,
-process, and counts of `/metrics` requests); dnswatcher records no metrics of
-its own.
-
-Every route but `/metrics` may be read from a page on any origin: a cross-origin
-`GET` gets `Access-Control-Allow-Origin: *`. Only `GET` is allowed cross-origin,
-and without credentials. `/metrics` sends no CORS headers.
+| `GET /metrics`                 | Prometheus metrics (optional) |
 
 #### Server timeouts
 
@@ -356,8 +333,8 @@ following precedence (highest to lowest):
 | `DNSWATCHER_TLS_INTERVAL`           | TLS check interval, a positive duration such as `6h`; empty means the default, anything else stops startup  | `12h`                 |
 | `DNSWATCHER_TLS_EXPIRY_WARNING`     | Days before expiry to warn                                                                                  | `7`                   |
 | `DNSWATCHER_SENTRY_DSN`             | Sentry DSN for error reporting                                                                              | `""`                  |
-| `DNSWATCHER_MAINTENANCE_MODE`       | Only sets `maintenanceMode` in the health check response; changes nothing else                              | `false`               |
-| `DNSWATCHER_METRICS_USERNAME`       | Basic auth username for /metrics, which is served only when this is set                                     | `""`                  |
+| `DNSWATCHER_MAINTENANCE_MODE`       | Enable maintenance mode                                                                                     | `false`               |
+| `DNSWATCHER_METRICS_USERNAME`       | Basic auth username for /metrics                                                                            | `""`                  |
 | `DNSWATCHER_METRICS_PASSWORD`       | Basic auth password for /metrics                                                                            | `""`                  |
 | `DNSWATCHER_SEND_TEST_NOTIFICATION` | Send a test notification after first scan completes                                                         | `false`               |
 
@@ -365,8 +342,7 @@ following precedence (highest to lowest):
 monitoring targets are configured. A monitoring daemon with nothing to monitor
 is a misconfiguration, so dnswatcher fails fast with a clear error message
 rather than running silently. Set `DNSWATCHER_TARGETS` to a comma-separated list
-of DNS names before starting. A name listed more than once, in any letter case
-or with a trailing dot, is watched once.
+of DNS names before starting.
 
 **`/metrics` is rate limited.** Each client address may send it 30 requests a
 minute, failed logins included; beyond that it answers `429 Too Many Requests`
@@ -408,30 +384,22 @@ DNSWATCHER_SEND_TEST_NOTIFICATION=true
 
 ## DNS Resolution Strategy
 
-dnswatcher never uses the system's configured recursive resolver for the names
-it watches. Instead, it performs full iterative resolution:
+dnswatcher never uses the system's configured recursive resolver. Instead, it
+performs full iterative resolution:
 
-1. **Root servers**: Starts from the IPv4 addresses of the 13 root servers,
-   built into the binary; the list is not refreshed.
+1. **Root servers**: Starts from the IANA root nameserver list (hardcoded, with
+   periodic refresh).
 2. **TLD delegation**: Queries root servers for the TLD NS records.
 3. **Domain delegation**: Queries TLD nameservers for the domain's NS records.
-   The delegation they give, from the domain's parent zone, is the domain's NS
-   record set.
 4. **Authoritative query**: Queries all discovered authoritative nameservers
    directly for the requested records.
 
-In steps 2 and 3 the servers are asked one at a time in a random order, chosen
-anew each time, so no one root server gets every first query. A server that does
-not reply, refuses the query, or gives an error reply such as SERVFAIL or a
-referral that leads no closer to the name is passed over for the next one. When
-a referral names a zone's nameservers without their addresses, the addresses of
-all of them are looked up, so that each can be asked.
-
 This approach ensures:
 
 - Independence from any upstream resolver's cache or filtering.
 - Ability to detect split-horizon or inconsistent responses across authoritative
   servers.
+- Visibility into the full delegation chain.
 
 A watched name's records are stored as its nameservers return them, CNAME
 included. When they return a CNAME and no address, the CNAME chain is followed
@@ -439,9 +407,6 @@ included. When they return a CNAME and no address, the CNAME chain is followed
 the port and TLS checks use those addresses. Nameservers' addresses are found
 the same way.
 
-Sending a notification or a Sentry report is the one use of the system's
-resolver: the HTTP client looks up the webhook's or Sentry's host name with it.
-
 ---
 
 ## State File Format
@@ -484,7 +449,6 @@ merged view, to enable inconsistency detection.
                     "lastChecked": "2026-02-19T12:00:00Z"
                 }
             },
-            "cnameAddresses": [],
             "lastChecked": "2026-02-19T12:00:00Z"
         }
     },
@@ -523,23 +487,17 @@ reachability:
 
 A nameserver that answers NXDOMAIN or with no records has status `ok` and empty
 `records`. A nameserver whose query failed, or that only referred it to other
-nameservers, has status `error`, empty `records`, and the reason in `error`. A
-certificate entry whose TLS connection or handshake failed likewise has status
-`error`, the reason in `error`, and the certificate fields left empty or zero.
+nameservers, has status `error`, empty `records`, and the reason in `error`.
 
 `nameserverAddresses` lists, by nameserver, the sorted addresses its name
 resolves to. A state file without it loads, and the next check fills it in
 without a notification.
 
 `cnameAddresses` lists the sorted addresses at the end of a hostname's CNAME
-chain, found when its nameservers answered with a CNAME and no address; it is
-empty when they answered with an address. When the chain cannot be followed, or
-none of the name's nameservers answered, the previous check's list is kept, or
-`null` when no earlier check saved one. A state file without it loads, and the
-first check after that saves it without a notification.
-
-A port entry in the older format, with one `hostname` instead of the `hostnames`
-list, loads as a list of that one name.
+chain, found when its nameservers answered with a CNAME and no address, and kept
+from the previous check when the chain cannot be followed or none of the name's
+nameservers answered. It is left out otherwise. A state file without it loads,
+and the next check fills it in without a notification.
 
 ---
 
@@ -678,12 +636,11 @@ docker run -d \
     - Port checks: every `DNSWATCHER_DNS_INTERVAL`, after DNS completes.
     - TLS checks: every `DNSWATCHER_TLS_INTERVAL` (default 12h), after DNS
       completes.
-    - Port and TLS checks use the IP addresses found by the DNS phase that
-      immediately precedes them. When that phase cannot find a name's
-      nameservers at all, the addresses an earlier check saved for the name are
-      used. When it cannot follow a name's CNAME chain, or none of the name's
-      nameservers answered, the addresses an earlier check found at the end of
-      the chain are used.
+    - Port and TLS checks always use freshly resolved IP addresses from the DNS
+      phase that immediately precedes them — never stale IPs from a previous
+      cycle, with one exception: when a name's CNAME chain cannot be followed,
+      or none of the name's nameservers answered, the addresses the previous
+      cycle found at the end of the chain are used.
 4. **On change detection**: Send notifications to all configured endpoints,
    update in-memory state, persist to disk.
 5. **Shutdown**: The watcher stops checking and saves the final state to disk,
@@ -732,51 +689,29 @@ file, so it survives a restart without an external database.
 cmd/dnswatcher/main.go         Entry point (uber/fx bootstrap)
 
 internal/
-  config/
-    config.go                  Viper-based configuration
-    classify.go                Splits targets into domains and hostnames
-                               (Public Suffix List)
+  config/config.go             Viper-based configuration
   globals/globals.go           Build-time variables (version)
   logger/logger.go             slog structured logging (TTY detection)
   healthcheck/healthcheck.go   Health check service
   middleware/middleware.go      HTTP middleware (logging, CORS, security
                                headers, metrics auth and rate limit)
-  handlers/
-    handlers.go                Shared handler setup and JSON responses
-    dashboard.go               Web dashboard
-    templates/dashboard.html   Dashboard template (embedded)
-    status.go                  /api/v1/status
-    healthcheck.go             Health check handler
+  handlers/handlers.go         HTTP request handlers
   server/
     server.go                  HTTP server lifecycle
     routes.go                  Route definitions
   state/state.go               JSON file state persistence
-  resolver/
-    resolver.go                Resolver setup and query status values
-    iterative.go               Iterative DNS resolution engine
-    dns_client.go              UDP and TCP DNS clients
-    errors.go                  Resolver errors
+  resolver/resolver.go         Iterative DNS resolution engine
   portcheck/portcheck.go       TCP port connectivity checker
   tlscheck/tlscheck.go        TLS certificate inspector
-  notify/
-    notify.go                  Notification service (Slack, Mattermost, ntfy)
-    retry.go                   Delivery retries with backoff
-    history.go                 Last 100 notifications, for the dashboard
-    shutdown.go                Waits for deliveries at shutdown
-  watcher/
-    watcher.go                 Main monitoring orchestrator and scheduler
-    interfaces.go              The resolver, checkers and notifier it uses
+  notify/notify.go             Notification service (Slack, Mattermost, ntfy)
+  watcher/watcher.go           Main monitoring orchestrator and scheduler
   livednstest/livednstest.go   Retry and concurrency limit for tests
                                against live DNS (imported only by tests)
-
-static/
-  static.go                    Embeds the CSS served under /s/
-  css/tailwind.min.css         Dashboard stylesheet
 ```
 
 ### Design Principles
 
-- **No recursive resolvers**: The watched names are resolved iteratively,
+- **No recursive resolvers**: All DNS resolution is performed iteratively,
   tracing from root nameservers through the delegation chain to authoritative
   servers.
 - **No external database**: State is persisted as a single JSON file.

TODO.md

@@ -19,14 +19,8 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 # Completed Steps
 
-- 2026-10-02: a watched name whose nameservers answer with a CNAME and no
+- 2026-10-01: a watched name whose nameservers answer with a CNAME and no
   address gets port and TLS checks at the end of its CNAME chain (closes #203).
-- 2026-10-02: the resolver tries root servers, and every other server list it
-  walks, in a random order each time, not always from the top (closes #138).
-- 2026-10-02: a name listed more than once in `DNSWATCHER_TARGETS`, in any
-  letter case or with a trailing dot, is watched once (closes #207).
-- 2026-10-01: README checked against the code and corrected: metrics, CORS,
-  notification retries, CNAMEs, state file fields, Design tree (closes #108).
 - 2026-10-01: a certificate within the expiry warning period is warned about on
   every TLS check, where some checks used to skip it at random (closes #204).
 - 2026-10-01: a domain's NS set is its delegation from the parent zone's
@@ -135,4 +129,6 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 - 1.0 readiness: run it with a real config and read the logs:
   https://git.eeqj.de/sneak/dnswatcher/issues/66
+- README accuracy sweep: https://git.eeqj.de/sneak/dnswatcher/issues/108
+- fixed root server order: https://git.eeqj.de/sneak/dnswatcher/issues/138
 - review toward 1.0: https://git.eeqj.de/sneak/dnswatcher/issues/144

internal/config/classify.go

@@ -57,22 +57,17 @@ func ClassifyDNSName(name string) (DNSNameType, error) {
 
 // ClassifyTargets splits a list of DNS names into apex domains and
 // hostnames using the Public Suffix List. It returns an error if any
-// name cannot be classified. A name given more than once, in any letter
-// case or with a trailing dot, is kept once.
+// name cannot be classified.
 func ClassifyTargets(targets []string) ([]string, []string, error) {
 	var domains, hostnames []string
 
-	seen := make(map[string]bool)
-
 	for _, t := range targets {
 		normalized := strings.ToLower(strings.TrimSuffix(strings.TrimSpace(t), "."))
 
-		if normalized == "" || seen[normalized] {
+		if normalized == "" {
 			continue
 		}
 
-		seen[normalized] = true
-
 		typ, classErr := ClassifyDNSName(normalized)
 		if classErr != nil {
 			return nil, nil, classErr

internal/config/classify_test.go

@@ -1,7 +1,6 @@
 package config_test
 
 import (
-	"slices"
 	"testing"
 
 	"sneak.berlin/go/dnswatcher/internal/config"
@@ -94,29 +93,6 @@ func TestClassifyTargets(t *testing.T) {
 	}
 }
 
-func TestClassifyTargetsKeepsEachNameOnce(t *testing.T) {
-	t.Parallel()
-
-	domains, hostnames, err := config.ClassifyTargets([]string{
-		"example.org",
-		"Example.org.",
-		"www.example.org",
-		"EXAMPLE.ORG",
-		"WWW.Example.org.",
-	})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	if !slices.Equal(domains, []string{"example.org"}) {
-		t.Errorf("domains = %v, want [example.org]", domains)
-	}
-
-	if !slices.Equal(hostnames, []string{"www.example.org"}) {
-		t.Errorf("hostnames = %v, want [www.example.org]", hostnames)
-	}
-}
-
 func TestClassifyTargetsRejectsPublicSuffix(t *testing.T) {
 	t.Parallel()
 

internal/livednstest/livednstest.go

@@ -9,11 +9,11 @@
 //
 //  1. Bounded concurrency. Tests run in parallel and the build hosts
 //     have many cores, so without a limit every test starts its own
-//     iterative resolution at the same instant and they all send their
-//     first queries to the root servers within a few milliseconds of
-//     each other. Root servers rate-limit that, which shows up as a
-//     different arbitrary subset of tests failing on each run. Run caps
-//     how many live operations are in flight at once in one test binary.
+//     iterative resolution at the same instant and they all hit the
+//     first root server within a few milliseconds of each other. Root
+//     servers rate-limit that, which shows up as a different arbitrary
+//     subset of tests failing on each run. Run caps how many live
+//     operations are in flight at once in one test binary.
 //
 //  2. Retry with exponential backoff. Each live operation gets several
 //     attempts with its own timeout. An attempt is retried when it

internal/resolver/export_test.go

@@ -36,24 +36,3 @@ func (r *Resolver) QueryEachNS(
 ) (map[string]*NameserverResponse, error) {
 	return r.queryEachNS(ctx, nameservers, hostname)
 }
-
-// ResolveNSIPs exports resolveNSIPs for testing.
-func (r *Resolver) ResolveNSIPs(
-	ctx context.Context,
-	nsNames []string,
-) []string {
-	return r.resolveNSIPs(ctx, nsNames)
-}
-
-// RootServerList exports rootServerList for testing.
-func RootServerList() []string {
-	return rootServerList()
-}
-
-// Shuffled exports shuffled for testing.
-func Shuffled(
-	servers []string,
-	shuffle func(n int, swap func(i, j int)),
-) []string {
-	return shuffled(servers, shuffle)
-}

internal/resolver/iterative.go

@@ -4,9 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"math/rand/v2"
 	"net"
-	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -261,25 +259,9 @@ func (r *Resolver) followDelegation(
 	return nil, ErrNoNameservers
 }
 
-// shuffled returns a copy of servers in the order shuffle puts them
-// in. The resolver passes rand.Shuffle, so each time it walks a list of
-// servers it starts at a random one, and no one server gets every
-// first query.
-func shuffled(
-	servers []string,
-	shuffle func(n int, swap func(i, j int)),
-) []string {
-	order := slices.Clone(servers)
-	shuffle(len(order), func(i, j int) {
-		order[i], order[j] = order[j], order[i]
-	})
-
-	return order
-}
-
-// queryServers asks servers, the servers of zone, about name in a random
-// order until one gives a usable reply. A server that times out, refuses
-// or gives a reply that is not usable is passed over for the next.
+// queryServers asks servers, the servers of zone, about name until one
+// gives a usable reply. A server that times out, refuses or gives a
+// reply that is not usable is passed over for the next.
 func (r *Resolver) queryServers(
 	ctx context.Context,
 	servers []string,
@@ -289,7 +271,7 @@ func (r *Resolver) queryServers(
 ) (*dns.Msg, error) {
 	var lastErr error
 
-	for _, ip := range shuffled(servers, rand.Shuffle) {
+	for _, ip := range servers {
 		if checkCtx(ctx) != nil {
 			return nil, ErrContextCanceled
 		}
@@ -358,10 +340,6 @@ func nsSetFrom(resp *dns.Msg, domain string) []string {
 	return extractNSSet(resp.Answer)
 }
 
-// resolveNSIPs returns the addresses of every nameserver in nsNames
-// whose name resolves, for a referral that carries none. The walk can
-// then go on to the zone's other nameservers when one gives no usable
-// reply.
 func (r *Resolver) resolveNSIPs(
 	ctx context.Context,
 	nsNames []string,
@@ -373,6 +351,10 @@ func (r *Resolver) resolveNSIPs(
 		if err == nil {
 			ips = append(ips, resolved...)
 		}
+
+		if len(ips) > 0 {
+			break
+		}
 	}
 
 	return ips

internal/resolver/iterative_test.go

@@ -1,8 +1,6 @@
 package resolver_test
 
 import (
-	"math/rand/v2"
-	"slices"
 	"testing"
 
 	"github.com/miekg/dns"
@@ -237,30 +235,3 @@ func TestExtractRecordValue_LetterCase(t *testing.T) {
 		})
 	}
 }
-
-// TestShuffled shuffles the root servers with many seeds. Every order
-// must hold each root server once, so each is tried before a
-// resolution fails; each root server must come first for some seed, so
-// no one root server gets every first query; and the list passed in
-// must be left as it was.
-func TestShuffled(t *testing.T) {
-	t.Parallel()
-
-	const seeds = 1000
-
-	roots := resolver.RootServerList()
-	before := slices.Clone(roots)
-	first := make(map[string]bool)
-
-	for seed := range uint64(seeds) {
-		rng := rand.New(rand.NewPCG(seed, 0)) //nolint:gosec // seeded on purpose
-		order := resolver.Shuffled(roots, rng.Shuffle)
-
-		assert.ElementsMatch(t, roots, order)
-
-		first[order[0]] = true
-	}
-
-	assert.Len(t, first, len(roots))
-	assert.Equal(t, before, roots)
-}

internal/resolver/livedns_test.go

@@ -383,37 +383,3 @@ func liveResolveIPsAllowingEmpty(
 
 	return out
 }
-
-// liveResolveNSIPs looks up the addresses of the nameservers named
-// names, retrying until there are at least atLeast of them: a name
-// whose lookup got no reply is left out of the result, not an error.
-func liveResolveNSIPs(
-	t *testing.T,
-	r *resolver.Resolver,
-	names []string,
-	atLeast int,
-) []string {
-	t.Helper()
-
-	var out []string
-
-	livednstest.Retry(
-		t,
-		"ResolveNSIPs("+strings.Join(names, ", ")+")",
-		func(ctx context.Context) error {
-			ips := r.ResolveNSIPs(ctx, names)
-			if len(ips) < atLeast {
-				return fmt.Errorf(
-					"%w: %d addresses, expected at least %d",
-					livednstest.ErrNoAnswer, len(ips), atLeast,
-				)
-			}
-
-			out = ips
-
-			return nil
-		},
-	)
-
-	return out
-}

internal/resolver/resolver_test.go

@@ -139,28 +139,6 @@ func TestFindAuthoritativeNameservers_CloudflareDomain(
 	}
 }
 
-// TestResolveNSIPs_EveryNameserver looks up the addresses of two of
-// google.com's nameservers together, as the walk does when a referral
-// names a zone's nameservers without their addresses, and compares them
-// with each looked up alone. Together they must give the addresses of
-// both, not only of the first that resolves, so that when one gives no
-// usable reply the walk goes on to the other.
-func TestResolveNSIPs_EveryNameserver(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-	names := []string{"ns3.google.com.", "ns4.google.com."}
-	want := make([]string, 0, len(names))
-
-	for _, name := range names {
-		want = append(want, liveResolveNSIPs(t, r, []string{name}, 1)...)
-	}
-
-	got := liveResolveNSIPs(t, r, names, len(want))
-
-	assert.ElementsMatch(t, want, got)
-}
-
 // ----------------------------------------------------------------
 // QueryNameserver tests
 // ----------------------------------------------------------------

internal/state/state.go

@@ -55,11 +55,10 @@ type NameserverRecordState struct {
 // HostnameState holds per-nameserver monitoring state for a hostname.
 // CNAMEAddresses holds the sorted addresses at the end of the name's
 // CNAME chain, found when its nameservers answered with a CNAME and no
-// address; it is empty otherwise. It is nil when they are not known: a
-// state file written before it existed loads with it nil.
+// address; it is empty otherwise.
 type HostnameState struct {
 	RecordsByNameserver map[string]*NameserverRecordState `json:"recordsByNameserver"`
-	CNAMEAddresses      []string                          `json:"cnameAddresses"`
+	CNAMEAddresses      []string                          `json:"cnameAddresses,omitempty"`
 	LastChecked         time.Time                         `json:"lastChecked"`
 }
 

internal/state/state_test.go

@@ -188,95 +188,6 @@ func TestLoadStateFromBeforeNameserverAddresses(t *testing.T) {
 	}
 }
 
-// TestSaveLoadRoundTrip_CNAMEAddresses checks that no addresses at the
-// end of a hostname's CNAME chain load as an empty list, and addresses
-// that are not known load as nil: the watcher tells the two apart.
-func TestSaveLoadRoundTrip_CNAMEAddresses(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	s := state.NewForTestWithDataDir(dir)
-
-	want := map[string][]string{
-		"cname.example.com":     {testIP},
-		"none.example.com":      {},
-		"not-known.example.com": nil,
-	}
-
-	for name, addresses := range want {
-		s.SetHostnameState(name, &state.HostnameState{
-			CNAMEAddresses: addresses,
-		})
-	}
-
-	err := s.Save()
-	if err != nil {
-		t.Fatalf("Save() error: %v", err)
-	}
-
-	loaded := state.NewForTestWithDataDir(dir)
-
-	err = loaded.Load()
-	if err != nil {
-		t.Fatalf("Load() error: %v", err)
-	}
-
-	for name, addresses := range want {
-		hs, ok := loaded.GetHostnameState(name)
-		if !ok {
-			t.Fatalf("missing hostname %s", name)
-		}
-
-		if !reflect.DeepEqual(hs.CNAMEAddresses, addresses) {
-			t.Errorf(
-				"%s: loaded %#v, want %#v",
-				name, hs.CNAMEAddresses, addresses,
-			)
-		}
-	}
-}
-
-// TestLoadStateFromBeforeCNAMEAddresses loads a state file written
-// before the addresses at the end of a hostname's CNAME chain were
-// saved. They load as not known (nil), not as none.
-func TestLoadStateFromBeforeCNAMEAddresses(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-
-	data := []byte(`{
-		"version": 1,
-		"lastUpdated": "2026-02-19T12:00:00Z",
-		"hostnames": {
-			"www.example.com": {
-				"recordsByNameserver": {},
-				"lastChecked": "2026-02-19T12:00:00Z"
-			}
-		}
-	}`)
-
-	err := os.WriteFile(filepath.Join(dir, "state.json"), data, 0o600)
-	if err != nil {
-		t.Fatalf("writing state file: %v", err)
-	}
-
-	s := state.NewForTestWithDataDir(dir)
-
-	err = s.Load()
-	if err != nil {
-		t.Fatalf("Load() error: %v", err)
-	}
-
-	hs, ok := s.GetHostnameState(testHostname)
-	if !ok {
-		t.Fatal("missing hostname " + testHostname)
-	}
-
-	if hs.CNAMEAddresses != nil {
-		t.Errorf("CNAME addresses: got %#v, want nil", hs.CNAMEAddresses)
-	}
-}
-
 // TestSaveLoadRoundTrip_Hostnames verifies hostname data survives a save/load cycle.
 func TestSaveLoadRoundTrip_Hostnames(t *testing.T) {
 	t.Parallel()

internal/watcher/cname_test.go

@@ -112,13 +112,12 @@ func TestCNAMEWhoseNameserversAllFailedKeepsPrevious(t *testing.T) {
 
 // cnameState builds the state a check leaves behind for a name whose
 // nameserver answered with a CNAME and no address, when following the
-// CNAME found these addresses, which may be none.
+// CNAME found these addresses.
 func cnameState(addresses ...string) *state.HostnameState {
 	hs := hostnameState(map[string]map[string][]string{
 		nsA: {"CNAME": {"target.example.org."}},
 	})
-
-	hs.CNAMEAddresses = append([]string{}, addresses...)
+	hs.CNAMEAddresses = addresses
 
 	return hs
 }
@@ -126,11 +125,6 @@ func cnameState(addresses ...string) *state.HostnameState {
 func TestCNAMEAddressChangeAlerts(t *testing.T) {
 	t.Parallel()
 
-	// A state file written before the addresses were saved loads with
-	// them nil.
-	olderStateFile := cnameState()
-	olderStateFile.CNAMEAddresses = nil
-
 	// Each case is the state saved by the previous check and by the
 	// current one. The name's records are the same in both.
 	tests := []struct {
@@ -158,13 +152,9 @@ func TestCNAMEAddressChangeAlerts(t *testing.T) {
 			"no address at the end of the chain now",
 			cnameState(ip1), cnameState(), 1,
 		},
-		{
-			"addresses at the end of the chain again",
-			cnameState(), cnameState(ip1), 1,
-		},
 		{
 			"state file from before addresses were saved",
-			olderStateFile, cnameState(ip1), 0,
+			cnameState(), cnameState(ip1), 0,
 		},
 	}
 
@@ -207,32 +197,3 @@ func TestCNAMEAddressChangeAlertNamesHostnameAndAddresses(t *testing.T) {
 		t.Errorf("sent %v, want %v", got, want)
 	}
 }
-
-// TestNameMovedFromARecordsToCNAMEAlerts checks a name that answers
-// with an A record and then with a CNAME whose chain ends in ip2. The
-// second check is notified as a CNAME address change from no addresses,
-// beside the record change. Nothing is looked up: the watcher has no
-// resolver.
-func TestNameMovedFromARecordsToCNAMEAlerts(t *testing.T) {
-	t.Parallel()
-
-	notifier := &mockNotifier{}
-	w := watcher.NewForTest(nil, nil, nil, nil, nil, notifier)
-
-	prev := hostnameState(map[string]map[string][]string{
-		nsA: {"A": {ip1}},
-	})
-	w.ResolveCNAMEAddresses(t.Context(), host, prev, nil)
-
-	w.DetectHostnameChanges(t.Context(), host, prev, cnameState(ip2))
-
-	title := "CNAME Address Change: " + host
-	message := "Hostname: " + host + "\nOld: \nNew: " + ip2
-
-	got := notifier.getNotifications()
-	if !slices.ContainsFunc(got, func(n notification) bool {
-		return n.Title == title && n.Message == message
-	}) {
-		t.Errorf("sent %v, want %q with %q among them", got, title, message)
-	}
-}

internal/watcher/watcher.go

@@ -394,11 +394,11 @@ func (w *Watcher) checkHostname(
 
 // resolveCNAMEAddresses saves in current the addresses at the end of
 // hostname's CNAME chain, when the nameservers' answers in current hold
-// a CNAME and no address, and an empty list otherwise.
-// ResolveIPAddresses looks the name up again and follows the chain. The
-// addresses saved in prev, which may be nil, are kept when none of the
-// name's nameservers answered, and when the chain cannot be followed, as
-// when no nameserver of a zone in it answers.
+// a CNAME and no address. ResolveIPAddresses looks the name up again
+// and follows the chain. The addresses saved in prev, which may be nil,
+// are kept when none of the name's nameservers answered, and when the
+// chain cannot be followed, as when no nameserver of a zone in it
+// answers.
 func (w *Watcher) resolveCNAMEAddresses(
 	ctx context.Context,
 	hostname string,
@@ -409,9 +409,6 @@ func (w *Watcher) resolveCNAMEAddresses(
 		prevAddresses = prev.CNAMEAddresses
 	}
 
-	// Empty, not nil: nil means the addresses are not known.
-	current.CNAMEAddresses = []string{}
-
 	answered := false
 	hasCNAME := false
 
@@ -454,9 +451,7 @@ func (w *Watcher) resolveCNAMEAddresses(
 		return
 	}
 
-	// Appended to the empty list, so a chain that ends in no address is
-	// saved as empty, not nil.
-	current.CNAMEAddresses = append(current.CNAMEAddresses, ips...)
+	current.CNAMEAddresses = ips
 }
 
 // buildHostnameState saves each nameserver's response. A nameserver
@@ -507,16 +502,16 @@ func (w *Watcher) detectHostnameChanges(
 
 // detectCNAMEAddressChanges notifies when the addresses at the end of
 // hostname's CNAME chain differ from those the previous check saved,
-// including a change from or to none. When the previous addresses are
-// not known (nil), as on the first check after loading a state file
-// written before they were saved, nothing is compared.
+// including when there are none now. When the previous check saved
+// none, as in a state file from before they were saved, nothing is
+// compared.
 func (w *Watcher) detectCNAMEAddressChanges(
 	ctx context.Context,
 	hostname string,
 	prev, current *state.HostnameState,
 ) {
 	old, cur := prev.CNAMEAddresses, current.CNAMEAddresses
-	if old == nil || sliceEqual(old, cur) {
+	if len(old) == 0 || sliceEqual(old, cur) {
 		return
 	}