watcher: a hostname whose zone's nameservers all stop answering gets NS Failure (closes #284)

When none of the nameservers of a hostname's zone answered, the walk to
them failed and the check was only logged. The walk now returns a
NoAnswerError naming the nameservers of the zone it reached when none
of them answers. When those are the nameservers the previous check
saved for the hostname, each is saved as failed with the reason, as a
domain's are, so it gets an NS Failure and later an NS Recovery. A walk
that fails before that zone, as when the host loses its network, is
still only logged.

Not tested live: the resolver naming a zone's nameservers that never
answer, as no live zone has such nameservers; the watcher test builds
that error.

Model: opus-5-5

README.md

@@ -104,11 +104,9 @@ notification endpoint set, changes show only on the dashboard; see
   NS change notification above. A domain listed in
   `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no record change or inconsistency
   notification. A domain with no delegation of its own has these records asked
-  at the servers of the zone it is in, as a hostname has. When none of those
-  servers answers, the lookup of its NS record set fails, and they are saved as
-  failed and notified as a hostname's are (see below). A nameserver the domain's
-  records were asked at on the previous check but not on this one gets a
-  hostname's NS change notification (see below), unless it was in the domain's
+  at the servers of the zone it is in, as a hostname has. A nameserver the
+  domain's records were asked at on the previous check but not on this one gets
+  a hostname's NS change notification (see below), unless it was in the domain's
   delegation on the previous check, as when that delegation is withdrawn. A
   domain that does not exist has none: they are not asked for, and those saved
   by an earlier check are removed without a notification.

TODO.md

@@ -19,8 +19,8 @@ milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
 
 # Completed Steps
 
-- 2026-10-13: a hostname or a domain whose zone's nameservers all stop answering
-  gets an NS Failure for each, then an NS Recovery (closes #284).
+- 2026-10-13: a hostname whose zone's nameservers all stop answering gets an NS
+  Failure for each, and an NS Recovery when they answer again (closes #284).
 - 2026-10-13: an IPv6 address is written in brackets before its port, as in
   `[2001:db8::1]:443`, in keys and Port Change notifications (closes #270).
 - 2026-10-13: `TODO.md` names only open issues as next and future steps, and its

internal/resolver/export_test.go

@@ -31,11 +31,9 @@ func NewWithQueryTimeout(log *slog.Logger, timeout time.Duration) *Resolver {
 func (r *Resolver) FollowDelegation(
 	ctx context.Context,
 	domain string,
-	zone string,
-	nameservers []string,
 	servers []string,
 ) ([]string, error) {
-	return r.followDelegation(ctx, domain, zone, nameservers, servers)
+	return r.followDelegation(ctx, domain, servers)
 }
 
 // FindAuthoritativeNameserversFrom exports findAuthoritativeNameservers

internal/resolver/iterative.go

@@ -204,13 +204,10 @@ func glueIPs(nsNames []string, glue map[string][]net.IP) []string {
 	return ips
 }
 
-// followDelegation follows referrals to domain from servers, the
-// addresses of the servers of zone, and returns the NS set of domain's
-// delegation. nameservers are the names a referral gave the servers of
-// zone; the walk to a name's nameservers starts at the root servers, the
-// servers of zone ".", which no referral names. When the servers of the
-// zone domain is in answer that domain does not exist, the error is
-// ErrNXDomain. When they answer that it has no delegation of its own,
+// followDelegation follows referrals from servers, the root servers, to
+// domain and returns the NS set of domain's delegation. When the servers
+// of the zone domain is in answer that domain does not exist, the error
+// is ErrNXDomain. When they answer that it has no delegation of its own,
 // because it is not the zone's apex, the set is empty and there is no
 // error. Any other error means that no such answer came; it is a
 // *NoAnswerError when the servers that did not answer are those of a
@@ -218,11 +215,13 @@ func glueIPs(nsNames []string, glue map[string][]net.IP) []string {
 func (r *Resolver) followDelegation(
 	ctx context.Context,
 	domain string,
-	zone string,
-	nameservers []string,
 	servers []string,
 ) ([]string, error) {
-	var withoutAddresses []string
+	// servers are the root servers, the servers of zone ".". After a
+	// referral, nameservers are the names of the servers of zone.
+	zone := "."
+
+	var nameservers, withoutAddresses []string
 
 	for range maxDelegation {
 		if checkCtx(ctx) != nil {
@@ -667,7 +666,7 @@ func (r *Resolver) findAuthoritativeNameservers(
 
 		candidate := strings.Join(labels[i:], ".") + "."
 
-		nsNames, err := r.followDelegation(ctx, candidate, ".", nil, servers)
+		nsNames, err := r.followDelegation(ctx, candidate, servers)
 		if err != nil && !errors.Is(err, ErrNXDomain) {
 			return nil, err
 		}
@@ -1079,7 +1078,7 @@ func (r *Resolver) LookupNS(
 	}
 
 	return r.followDelegation(
-		ctx, dns.Fqdn(strings.ToLower(domain)), ".", nil, rootServerList(),
+		ctx, dns.Fqdn(strings.ToLower(domain)), rootServerList(),
 	)
 }
 

internal/resolver/resolver_test.go

@@ -959,34 +959,12 @@ func TestFollowDelegation_NoAnswer(t *testing.T) {
 	r := resolver.NewWithQueryTimeout(slog.Default(), 100*time.Millisecond)
 
 	nameservers, err := r.FollowDelegation(
-		t.Context(), "google.com.", ".", nil, []string{noAnswerAddress},
+		t.Context(), "google.com.", []string{noAnswerAddress},
 	)
 	require.Error(t, err)
 	assert.Empty(t, nameservers)
 }
 
-// TestFollowDelegation_NoAnswerAfterReferral starts the walk for
-// www.example.net at the servers of example.net as a referral names
-// them, ns1.example.net and ns2.example.net, at 192.0.2.1, where nothing
-// answers. The error is a NoAnswerError naming them, which the watcher
-// compares with the nameservers it saved for the name.
-func TestFollowDelegation_NoAnswerAfterReferral(t *testing.T) {
-	t.Parallel()
-
-	r := resolver.NewWithQueryTimeout(slog.Default(), 100*time.Millisecond)
-	nameservers := []string{"ns1.example.net.", "ns2.example.net."}
-
-	_, err := r.FollowDelegation(
-		t.Context(), "www.example.net.", "example.net.", nameservers,
-		[]string{noAnswerAddress},
-	)
-
-	var noAnswer *resolver.NoAnswerError
-	require.ErrorAs(t, err, &noAnswer)
-	assert.Equal(t, nameservers, noAnswer.Nameservers)
-	assert.Contains(t, err.Error(), "query www.example.net. @"+noAnswerAddress)
-}
-
 // TestResolveNSIterative_NoDelegationOfItsOwn walks to the nameservers
 // of www.google.com as the fallback walk does. As in
 // TestLookupNS_NoDelegationOfItsOwn, the set is empty, with no error.

internal/watcher/export_test.go

@@ -122,26 +122,6 @@ func (w *Watcher) RunTLSChecks(ctx context.Context) {
 	w.runTLSChecks(ctx)
 }
 
-// CheckHostnameResult exports checkHostnameResult for testing.
-func (w *Watcher) CheckHostnameResult(
-	ctx context.Context,
-	hostname string,
-	results map[string]*resolver.NameserverResponse,
-	err error,
-) bool {
-	return w.checkHostnameResult(ctx, hostname, results, err)
-}
-
-// CheckDomainResult exports checkDomainResult for testing.
-func (w *Watcher) CheckDomainResult(
-	ctx context.Context,
-	domain string,
-	nameservers []string,
-	err error,
-) {
-	w.checkDomainResult(ctx, domain, nameservers, err)
-}
-
 // FailedNameservers exports failedNameservers for testing.
 func FailedNameservers(
 	err error,

internal/watcher/nsfailure_test.go

@@ -188,86 +188,68 @@ func TestNSFailureAlertNamesHostnameNameserverAndReason(t *testing.T) {
 	}
 }
 
-// TestZoneNameserversAllStopAnswering runs three checks of host from
-// the point where its lookup has returned. On the first, nsA and nsB,
-// the nameservers of its zone, answer. On the second, the lookup fails
-// with the error the walk to them returns when neither answers (see
-// the resolver's TestFollowDelegation_NoAnswerAfterReferral), given
-// here because no live zone has nameservers that never answer. For a
-// hostname it is the lookup of its records that fails, and for a domain
-// with no delegation of its own the lookup of its delegation. Both are
-// saved as failed, with the reason, and each gets an NS Failure. On the
-// third, both answer, and each gets an NS Recovery. A domain's records
-// are checked as a hostname's, so its first and third checks are too.
-func TestZoneNameserversAllStopAnswering(t *testing.T) {
+// TestHostnameWhoseNameserversAllStopAnswering starts from a check of
+// host in which nsA and nsB answered, then gives the watcher the error
+// the walk to host's nameservers returns when it reached their zone and
+// neither answered. No live zone has nameservers that never answer, so
+// the error is built here. Both are saved as failed, with the reason,
+// and each gets an NS Failure. On the next check both answer, and each
+// gets an NS Recovery.
+func TestHostnameWhoseNameserversAllStopAnswering(t *testing.T) {
 	t.Parallel()
 
+	cfg := defaultTestConfig(t)
+	cfg.Hostnames = []string{host}
+
+	// The watcher is given each check's lookup result, so it has no
+	// resolver.
+	deps := newTestDeps(t, cfg)
+	w := watcher.NewForTest(
+		cfg, deps.state, nil,
+		deps.portChecker, deps.tlsChecker, deps.notifier,
+	)
+	w.SetFirstRun(false)
+
 	records := map[string][]string{"A": {ip1}}
 	bothAnswer := map[string]*resolver.NameserverResponse{
 		nsA: response(records), nsB: response(records),
 	}
-	noAnswer := &resolver.NoAnswerError{
+
+	deps.state.SetHostnameState(
+		host, watcher.BuildHostnameState(bothAnswer, nil, time.Now()),
+	)
+
+	err := &resolver.NoAnswerError{
 		Nameservers: []string{nsA, nsB}, Err: errNoReply,
 	}
 
-	tests := []struct {
-		name     string
-		isDomain bool
-	}{
-		{"hostname", false},
-		{"domain with no delegation of its own", true},
+	prev, _ := deps.state.GetHostnameState(host)
+	w.UpdateHostnameState(t.Context(), host, watcher.BuildHostnameState(
+		watcher.FailedNameservers(err, prev), prev, time.Now(),
+	))
+
+	current, _ := deps.state.GetHostnameState(host)
+
+	for _, ns := range []string{nsA, nsB} {
+		got := current.RecordsByNameserver[ns]
+		if got.Status != failed().Status || got.Error != err.Error() {
+			t.Errorf(
+				"%s saved with status %q, error %q; want %q, %q",
+				ns, got.Status, got.Error, failed().Status, err.Error(),
+			)
+		}
 	}
 
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
+	if n := countNotifications(deps, "NS Failure: "+host); n != 2 {
+		t.Errorf("sent %d NS Failure notifications, want 2", n)
+	}
 
-			cfg := defaultTestConfig(t)
-			if tt.isDomain {
-				cfg.Domains = []string{host}
-			} else {
-				cfg.Hostnames = []string{host}
-			}
+	w.UpdateHostnameState(t.Context(), host, watcher.BuildHostnameState(
+		bothAnswer, current, time.Now(),
+	))
 
-			// The watcher is given each lookup's result, so it has no
-			// resolver.
-			deps := newTestDeps(t, cfg)
-			w := watcher.NewForTest(
-				cfg, deps.state, nil,
-				deps.portChecker, deps.tlsChecker, deps.notifier,
-			)
-			w.SetFirstRun(false)
-
-			w.CheckHostnameResult(t.Context(), host, bothAnswer, nil)
-
-			if tt.isDomain {
-				w.CheckDomainResult(t.Context(), host, nil, noAnswer)
-			} else {
-				w.CheckHostnameResult(t.Context(), host, nil, noAnswer)
-			}
-
-			current, _ := deps.state.GetHostnameState(host)
-
-			for _, ns := range []string{nsA, nsB} {
-				got := current.RecordsByNameserver[ns]
-				if got.Status != failed().Status || got.Error != errNoReply.Error() {
-					t.Errorf(
-						"%s saved with status %q, error %q; want %q, %q",
-						ns, got.Status, got.Error, failed().Status, errNoReply,
-					)
-				}
-			}
-
-			if n := countNotifications(deps, "NS Failure: "+host); n != 2 {
-				t.Errorf("sent %d NS Failure notifications, want 2", n)
-			}
-
-			w.CheckHostnameResult(t.Context(), host, bothAnswer, nil)
-
-			if n := countNotifications(deps, "NS Recovery: "+host); n != 2 {
-				t.Errorf("sent %d NS Recovery notifications, want 2", n)
-			}
-		})
+	if n := countNotifications(deps, "NS Recovery: "+host); n != 2 {
+		t.Errorf("sent %d NS Recovery notifications, want 2", n)
 	}
 }
 

internal/watcher/watcher.go

@@ -291,25 +291,12 @@ func (w *Watcher) logFailedLookup(
 	w.log.Error(msg, args...)
 }
 
-// checkDomain looks up domain's delegation and checks domain with it
-// (see checkDomainResult).
 func (w *Watcher) checkDomain(
 	ctx context.Context,
 	domain string,
 ) {
 	nameservers, err := w.resolver.LookupNS(ctx, domain)
 
-	w.checkDomainResult(ctx, domain, nameservers, err)
-}
-
-// checkDomainResult finishes a check of domain from nameservers and err,
-// what the lookup of its delegation returned.
-func (w *Watcher) checkDomainResult(
-	ctx context.Context,
-	domain string,
-	nameservers []string,
-	err error,
-) {
 	// A domain that does not exist has no nameservers.
 	nxdomain := errors.Is(err, resolver.ErrNXDomain)
 	if nxdomain {
@@ -324,12 +311,6 @@ func (w *Watcher) checkDomainResult(
 			"error", err,
 		)
 
-		// For a domain with no delegation of its own, the servers that
-		// did not answer can be those of the zone it is in, at which
-		// its records are asked. They are then saved as failed, as a
-		// hostname's are.
-		w.checkHostnameResult(ctx, domain, nil, err)
-
 		return
 	}
 
@@ -483,13 +464,16 @@ func (w *Watcher) detectNSAddressChanges(
 	}
 }
 
-// checkHostname looks up hostname's records and checks them (see
-// checkHostnameResult). It reports whether it saved them.
+// checkHostname checks hostname's records and reports whether it saved
+// them; it does not when their lookup fails, unless the nameservers that
+// did not answer are those of the previous check (see failedNameservers).
 func (w *Watcher) checkHostname(
 	ctx context.Context,
 	hostname string,
 ) bool {
 	results, err := w.resolver.LookupAllRecords(ctx, hostname)
+	prev, _ := w.state.GetHostnameState(hostname)
+
 	if err != nil {
 		w.logFailedLookup(
 			ctx,
@@ -497,25 +481,7 @@ func (w *Watcher) checkHostname(
 			"hostname", hostname,
 			"error", err,
 		)
-	}
 
-	return w.checkHostnameResult(ctx, hostname, results, err)
-}
-
-// checkHostnameResult finishes a check of hostname from results and err,
-// what the lookup of its records returned, and reports whether it saved
-// them. When the lookup failed, it saves nothing, unless the nameservers
-// that did not answer are those of the previous check (see
-// failedNameservers).
-func (w *Watcher) checkHostnameResult(
-	ctx context.Context,
-	hostname string,
-	results map[string]*resolver.NameserverResponse,
-	err error,
-) bool {
-	prev, _ := w.state.GetHostnameState(hostname)
-
-	if err != nil {
 		results = failedNameservers(err, prev)
 		if results == nil {
 			return false
@@ -862,7 +828,7 @@ func (w *Watcher) detectRecordChanges(
 // saved delegation, which detectNSChanges notifies when they are removed
 // from it. checkDomain saves a new delegation only after this runs, and
 // only together with the records, so the saved delegation and the
-// nameservers in prev come from the same check.
+// records in prev come from the same check.
 func (w *Watcher) detectNSDisappearances(
 	ctx context.Context,
 	hostname string,