resolver: a root server's reply marked recursion available means interception (closes #300)

dnswatcher never asks for recursion and a root server never offers it,
so a reply marked recursion available from a root server's address
came from a resolver on the network answering in its place. Such a
reply is now passed over, and when every root server refused or gave
one, the lookup fails with the existing "this network intercepts DNS
queries", whether or not that resolver had the name cached. Before, a
cached name was checked against the resolver's second-hand answer.

On such a network dnswatcher and its tests fail with that error, by
design; nothing asks again another way or works around it. A live test
passes public resolvers as the root servers and expects the error.

Model: opus-5-5

README.md

@@ -561,16 +561,16 @@ This approach ensures:
 - Ability to detect split-horizon or inconsistent responses across authoritative
   servers.
 
-dnswatcher never asks a server for recursion, so a reply marked "recursion
-available" did not come from the server it was sent to. It came from a recursive
-resolver on the network answering in that server's place, as on a network where
-a router rule, a VPN or a DNS filter sends all DNS to one resolver. Such a query
-is sent again over TCP, which many of those networks leave alone, and the reply
-over TCP is used; when that retry fails, the reply over UDP is kept. A root
-server never offers recursion, so a reply from a root server's address that is
-still marked so after that is passed over. When every root server refuses a
-query or gives such a reply, the lookup fails with the error "this network
-intercepts DNS queries".
+A root server never offers recursion, so a reply marked "recursion available"
+from a root server's address came from a recursive resolver on the network
+answering in its place, as on a network where a router rule, a VPN or a DNS
+filter sends all DNS to one resolver. Such a reply is passed over for the next
+root server. When every root server refuses a query or gives such a reply, the
+lookup fails with the error "this network intercepts DNS queries". Every lookup
+starts at the root servers, so on such a network every lookup fails with that
+error, whether or not that resolver has the name cached, and dnswatcher's tests
+fail there too. That is by design: nothing asks again another way or otherwise
+works around the interception.
 
 A watched name's records are stored as its nameservers return them, CNAME
 included. When they return a CNAME and no address, the chain of every CNAME

TODO.md

@@ -19,10 +19,10 @@ milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
 
 # Completed Steps
 
-- 2026-10-16: a reply over UDP marked "recursion available" is asked again over
-  TCP; such a reply from a root server's address is not used, and when every
-  root server refuses or gives one, the error is "this network intercepts DNS
-  queries" (closes #300).
+- 2026-10-16: a reply marked "recursion available" from a root server's address
+  is not used; when every root server refuses or gives one, the lookup fails
+  with "this network intercepts DNS queries", so on such a network dnswatcher
+  and its tests fail, by design (closes #300).
 - 2026-10-15: a query its caller's context ends before it is sent records no
   reason about the nameserver, and a try the context's deadline cuts short is a
   timeout, so a nameserver whose only failures were timeouts is `timeout`, not a

internal/resolver/errors.go

@@ -53,9 +53,9 @@ var (
 		"reply truncated and its retry over TCP failed",
 	)
 
-	// ErrRecursionAvailable is the reason a reply from a root server
-	// marked recursion available is not used. Root servers offer no
-	// recursion, so the reply came from something on the network
+	// ErrRecursionAvailable is the reason a reply from a root server's
+	// address marked recursion available is not used. Root servers offer
+	// no recursion, so the reply came from something on the network
 	// answering in their place.
 	ErrRecursionAvailable = errors.New(
 		"reply marked recursion available, so not from a root server",
@@ -64,7 +64,8 @@ var (
 	// ErrIntercepted is returned when every root server refused a
 	// query or gave a reply marked recursion available. Root servers do
 	// neither, so those replies came from something on the network
-	// answering in their place.
+	// answering in their place. On such a network dnswatcher fails with
+	// it, by design: nothing works around the interception.
 	ErrIntercepted = errors.New("this network intercepts DNS queries")
 
 	// ErrCNAMEDepthExceeded is returned when a CNAME chain

internal/resolver/iterative.go

@@ -94,18 +94,15 @@ func (r *Resolver) tryExchange(
 }
 
 // retryTCP returns the reply to msg over TCP when resp, its reply over
-// UDP, is truncated or marked recursion available. msg does not ask for
-// recursion, so a reply marked so came from a recursive resolver on the
-// network answering in the server's place, and many networks that send
-// DNS to one do so only for UDP. When the retry fails it returns resp;
-// a truncated one holds only the records that fit.
+// UDP, is truncated. When that fails it returns resp, still truncated,
+// which holds only the records that fit.
 func (r *Resolver) retryTCP(
 	ctx context.Context,
 	msg *dns.Msg,
 	addr string,
 	resp *dns.Msg,
 ) *dns.Msg {
-	if !resp.Truncated && !resp.RecursionAvailable {
+	if !resp.Truncated {
 		return resp
 	}
 
@@ -118,9 +115,7 @@ func (r *Resolver) retryTCP(
 }
 
 // queryDNS sends a DNS query to a specific server IP, never asking it
-// for recursion. When the reply over UDP is truncated or marked
-// recursion available, the query is sent again over TCP (see retryTCP).
-// A reply of REFUSED is returned as ErrRefused.
+// for recursion. A reply of REFUSED is returned as ErrRefused.
 func (r *Resolver) queryDNS(
 	ctx context.Context,
 	serverIP string,
@@ -143,15 +138,13 @@ func (r *Resolver) queryDNS(
 		return nil, fmt.Errorf("query %s @%s: %w", name, serverIP, err)
 	}
 
-	resp = r.retryTCP(ctx, msg, addr, resp)
-
 	if resp.Rcode == dns.RcodeRefused {
 		return nil, fmt.Errorf(
 			"query %s @%s: %w", name, serverIP, ErrRefused,
 		)
 	}
 
-	return resp, nil
+	return r.retryTCP(ctx, msg, addr, resp), nil
 }
 
 func extractNSSet(rrs []dns.RR) []string {

internal/resolver/resolver_test.go

@@ -853,12 +853,12 @@ func TestQueryServers_NotEveryRootServerRefused(t *testing.T) {
 // TestQueryServers_RecursiveResolversAsRootServers passes public
 // recursive resolvers of four operators to QueryServers as the servers
 // of the root zone, as a network that sends every DNS query to a
-// resolver would. Over UDP and over TCP alike, they mark every reply
-// recursion available, which no root server does. Each refuses the
-// query, replies SERVFAIL, or answers from its cache, as 1.1.1.1 does
-// for com.: a reply that would be used if a root server gave it. Either
-// way the error is ErrIntercepted, and since 1.1.1.1 and 8.8.8.8 refuse
-// no such query, it says a reply was marked recursion available.
+// resolver would. Each refuses the query or gives a reply marked
+// recursion available, which no root server does: SERVFAIL, or an
+// answer from its cache, as 1.1.1.1 gives for com., which would be used
+// if a root server gave it. Either way the error is ErrIntercepted, and
+// since 1.1.1.1 and 8.8.8.8 refuse no such query, it says a reply was
+// marked recursion available.
 func TestQueryServers_RecursiveResolversAsRootServers(t *testing.T) {
 	t.Parallel()