build: re-vendor canonical files from prompts dd4027b (closes #257)

The canonical files are fetched whole from sneak/prompts at dd4027b.
Kept after the canonical content: the livednstest deny entry in
.golangci.yml, /bin in .dockerignore, this repo's own .gitignore lines
and a [*.go] tab section in .editorconfig. The workflow keeps its
concurrency block and persist-credentials: false. Lint and test are
phases of the Dockerfile (golangci-lint v2.14.0; tests on the Debian
Go 1.25.7 image as an ordinary user, with the same flags); the build
stage depends on both and stamps the version the canonical way.
Dockerfile.lint is gone; the prettier stages of Dockerfile.fmt moved
into the Dockerfile. Every scripted docker build passes --no-cache;
script/cibuild bootstraps, runs script/check, then builds the image.
script/fmt-check absorbs fmt-check-go and fmt-check-markdown.

Model: opus-5-5

.dockerignore

@@ -1,9 +1,75 @@
-# .git is sent, without its config: the builder stage derives the version it
-# stamps into the binary from it, and `git describe` does not need the config,
-# which can hold a credential (a password in the remote URL, a CI token). No
-# tracked file may be listed here: git in the build would see it as deleted
-# and mark the version -dirty, and an excluded .md would silently drop out of
-# the prettier check in Dockerfile.fmt.
-.git/config
-bin/
-node_modules/
+# .dockerignore does NOT use .gitignore semantics. Docker matches with
+# moby/patternmatcher: filepath.Match plus `**`, so `*` does not cross
+# `/` and an unprefixed pattern is anchored at the context root. Every
+# depth-independent pattern therefore needs `**/`, or `config/.env` and
+# `certs/server.key` still ship while this file reads as solved. Only
+# genuinely root-anchored entries go unprefixed. Never transplant these
+# into .gitignore, where `**/` is wrong.
+#
+# Matching is case-sensitive, so secrets use character ranges rather
+# than an ALL-CAPS twin, which would still miss `Server.Key`.
+#
+# Extend with this repo's own host-built artifacts, written anchored:
+# `/myapp`, never `**/myapp`, which also matches `cmd/myapp/` and
+# deletes the package directory from the context.
+
+# .git is sent without its config. Without a VERSION build argument the
+# stage that compiles runs `git describe --tags --always` on .git, which
+# does not need .git/config; that file can hold a credential, such as a
+# password in a remote URL or the token the CI checkout step stores there.
+# Each submodule keeps a config with the same exposure in its git directory
+# under .git/modules/, nested again for a submodule's own submodules, or in
+# its own .git directory when it keeps one.
+# KNOWN GAP: a submodule whose name has a `config` segment (`config`,
+# `deploy/config`, `config/lib`) loses its whole git directory, because
+# `**/.git/modules/**/config` also matches that segment's directory
+# under .git/modules/. Go's version stamping then fails the build;
+# nothing leaks. Name such a submodule without that segment:
+# `git submodule add --name`.
+**/.git/config
+**/.git/modules/**/config
+
+# Agent scratch: one full checkout of the repo per in-flight agent.
+# Anchored because it occurs once where agents run at the repo root.
+# KNOWN GAP: a repo running agents in subdirectories still ships
+# `services/api/.claude/` and must add its own anchored entry.
+.claude
+
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Re-include a committed template with a negation if the
+# build needs one: `!docs/example.env`.
+**/*.[eE][nN][vV]
+**/.[eE][nN][vV].*
+**/.[eE][nN][vV][rR][cC]
+
+# Private keys and the bundles carrying them. Public certificates
+# (*.crt, *.cer) are deliberately absent: they are legitimate inputs.
+**/*.[pP][eE][mM]
+**/*.[kK][eE][yY]
+**/*.[pP]12
+**/*.[pP][fF][xX]
+**/[iI][dD]_[rR][sS][aA]
+**/[iI][dD]_[dD][sS][aA]
+**/[iI][dD]_[eE][cC][dD][sS][aA]
+**/[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
+**/[iI][dD]_[eE][dD]25519
+**/[iI][dD]_[eE][dD]25519_[sS][kK]
+
+# Dependencies: restored inside the image, never copied in.
+**/node_modules
+
+# OS metadata.
+**/.DS_Store
+**/Thumbs.db
+
+# Editor state: never a build input, and it churns COPY.
+**/*.swp
+**/*.swo
+**/*~
+**/*.bak
+**/.idea
+**/.vscode
+**/*.sublime-*
+
+# This repository's host-built artifacts: `make build` writes bin/.
+/bin

.editorconfig

@@ -10,3 +10,6 @@ insert_final_newline = true
 
 [Makefile]
 indent_style = tab
+
+[*.go]
+indent_style = tab

.gitea/workflows/check.yml

@@ -9,7 +9,7 @@ jobs:
     check:
         runs-on: ubuntu-latest
         steps:
-            # actions/checkout v4.2.2, 2026-02-28
+            # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
               # script/cibuild needs no token, so none is left in .git/config.
               with:

.gitignore

@@ -1,7 +1,57 @@
-bin/
+# OS
+.DS_Store
+Thumbs.db
+
+# Editors
+*.swp
+*.swo
+*~
+*.bak
+.idea/
+.vscode/
+*.sublime-*
+
+# Agent scratch (worktrees of this repo, created and destroyed by
+# in-flight tooling). Unanchored: .gitignore patterns already match at
+# every depth, so no prefix is wanted here. This is not a .dockerignore
+# entry and must not be given a `**/` prefix on the way into one.
+.claude/
+
+# Node
 node_modules/
+
+# Secrets. Unanchored like every entry above, so each matches at every
+# depth. Matching is case-sensitive on Linux, so names use character
+# ranges rather than a lowercase form that misses `Server.Key`.
+
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Only the templates `example.env` and `sample.env` are
+# re-included below. A repository that commits any other template adds
+# its own negation after these lines, for example `!.env.example`.
+*.[eE][nN][vV]
+.[eE][nN][vV].*
+.[eE][nN][vV][rR][cC]
+!example.env
+!sample.env
+
+# Private keys and the bundles carrying them.
+*.[pP][eE][mM]
+*.[kK][eE][yY]
+*.[pP]12
+*.[pP][fF][xX]
+[iI][dD]_[rR][sS][aA]
+[iI][dD]_[dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
+[iI][dD]_[eE][dD]25519
+[iI][dD]_[eE][dD]25519_[sS][kK]
+
+# This repository's own entries, kept after the canonical content above.
+*.log
+*.out
+*.test
+bin/
 vendor/
 data/
-.env
 *.exe
 /dnswatcher

.golangci.yml

@@ -17,6 +17,7 @@ linters:
   disable:
     # Genuinely incompatible with project patterns
     - exhaustruct      # Requires all struct fields
+    - exhaustruct_v5   # Requires all struct fields (successor to exhaustruct)
     - godot            # Requires comments to end with periods
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go

.prettierignore

@@ -1,5 +1,2 @@
-bin/
-data/
 node_modules/
-.claude/
-static/css/tailwind.min.css
+yarn.lock

Dockerfile

@@ -1,68 +1,102 @@
-# Lint stage - fast feedback on lint issues, before the build starts.
-# The linter is invoked directly rather than through `make lint`: that
-# target shells out to `docker build -f Dockerfile.lint`, and there is
-# no docker daemon inside a docker build. For the same reason this stage
-# runs only the Go half of `make fmt-check`; script/cibuild runs the
-# markdown half after this build.
-# script/cibuild and script/docker name this stage in --no-cache-filter.
-# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-10
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
-
+# Lint phase, built alone by script/lint. The linter is invoked directly
+# rather than through `make lint`, which is itself a docker build and
+# would recurse into a daemon that does not exist in a build step.
+# golangci/golangci-lint:v2.14.0 (Debian-based), 2026-10-06
+FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
-
 COPY . .
-
-RUN script/fmt-check-go
 RUN golangci-lint run --config .golangci.yml ./...
 
-# Build stage
-# script/cibuild and script/docker name this stage in --no-cache-filter.
-# golang 1.25-alpine, 2026-02-28
-FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder
-
-RUN apk add --no-cache git make gcc musl-dev binutils-gold
-
-# A build context sent as a tar archive keeps its files' owners, and git
-# refuses to read a checkout owned by another user. Trust this one
-# whoever owns it.
-RUN git config --system --add safe.directory /src
-
-# Force BuildKit to run the lint stage before proceeding
-COPY --from=lint /src/go.sum /dev/null
-
+# Test phase, built alone by script/test. -race needs cgo and so a C
+# compiler, which the Debian Go image ships and the alpine one does not.
+# The tests query live DNS (TESTING.md), so this step needs the network.
+# -count=1 keeps Go's test result cache out of both runs, as TESTING.md
+# requires. -timeout 90s is a backstop above the 60-second cap on the
+# suite. The rerun with -v only shows details: the build fails however
+# it ends, because the first run already failed.
+# golang 1.25.7-trixie, 2026-10-06
+FROM golang@sha256:2b174ffcf56c7ad0c47d30d2630693265639ddf2a5141149c2da34db921791b4 AS test
+# The file permission tests skip themselves as root, so the tests run as
+# an ordinary user, whose home directory holds Go's build cache.
+RUN useradd --create-home tester
+USER tester
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
+COPY . .
+RUN go test -count=1 -race -timeout 90s -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -count=1 -race -timeout 90s -v ./...; exit 1; }
 
+# Markdown formatting with prettier, at the version package.json and
+# yarn.lock pin, so it is never installed on the host. script/fmt-check
+# builds the fmt-check stage and script/fmt the fmt-out stage; the image
+# does not depend on any of these stages, so a plain `docker build .`
+# skips them.
+# node:22-bookworm-slim, 2026-09-05
+FROM node@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5 AS nodedeps
+# prettier lives outside /src, so the COPY of the repo cannot overwrite
+# it and node_modules is not in the tree prettier walks.
+WORKDIR /tools
+COPY package.json yarn.lock ./
+RUN yarn install --frozen-lockfile --non-interactive --no-progress
+ENV PATH="/tools/node_modules/.bin:${PATH}"
+WORKDIR /src
+
+# --config rather than discovery: a missing .prettierrc is then an error
+# instead of prettier's defaults, under which every wrap passes.
+# --no-editorconfig so .prettierrc alone sets the style.
+FROM nodedeps AS fmt-check
+COPY . .
+RUN prettier --config .prettierrc --no-editorconfig --check "**/*.md"
+
+# Only the markdown is copied out, with its paths, so the export cannot
+# put anything else back over the working tree.
+FROM nodedeps AS fmt
+COPY . .
+RUN prettier --config .prettierrc --no-editorconfig --write "**/*.md" && \
+    mkdir -p /out && \
+    find . -name '*.md' -type f -exec cp --parents '{}' /out/ ';'
+
+FROM scratch AS fmt-out
+COPY --from=fmt /out/ /
+
+# Build stage. Nothing is wanted from the lint and test phases; the
+# copies are what make BuildKit build them first, so this stage cannot
+# run unless lint and test passed.
+# golang 1.25-alpine, 2026-02-28
+FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder
+COPY --from=lint /src/go.sum /dev/null
+COPY --from=test /src/go.sum /dev/null
+RUN apk add --no-cache git
+# A tar-stream context keeps the sender's file owners, which git refuses.
+RUN git config --system --add safe.directory /src
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
 COPY . .
 
-# Run the tests - build fails if any test fails
-RUN make test
-
-# Version stamped into the binary: the VERSION build arg when one is
-# given and not empty (script/docker passes one), otherwise what
-# `git describe` says of the .git in the build context, so a plain
-# `docker build .` of a clone stamps its tag or short commit. The build
-# arg reaches make through the environment.
+# The VERSION build arg when one is given (script/docker and
+# script/cibuild pass one), otherwise `git describe --tags --always` on
+# the .git in the build context. With .git present, a version that is
+# still empty, dev or unknown fails the build: git is missing or could
+# not read the checkout.
 ARG VERSION
-
-# A context that carries .git, as a directory or as a file, must yield a
-# real version: one that is empty, `dev` or `unknown` cannot be traced
-# back to a commit.
-RUN version="$(make version)"; \
+RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
     if [ -e .git ]; then \
-        case "$version" in \
-            "" | dev | unknown) \
-                echo "version is \"$version\" although the build context carries .git" >&2; \
-                exit 1 ;; \
+        case "$VERSION" in ""|dev|unknown) \
+            echo "version is '$VERSION' although .git is present" >&2; \
+            exit 1 ;; \
         esac; \
-    fi
+    fi; \
+    CGO_ENABLED=0 go build -trimpath \
+        -ldflags="-s -w -X main.Version=${VERSION}" \
+        -o /src/bin/dnswatcher ./cmd/dnswatcher/
 
-RUN make build
-
-# Runtime stage
+# Runtime stage, and the last one: a plain `docker build .` builds this
+# stage's chain and nothing else.
 # alpine 3.21, 2026-02-28
 FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
 

Dockerfile.fmt

@@ -1,54 +0,0 @@
-# prettier over the markdown, in a container, so it is never installed
-# on the host. script/fmt-check-markdown builds the fmt-check stage;
-# script/fmt builds fmt-out and takes the formatted files back.
-
-# node:22-bookworm-slim, 2026-09-05
-FROM node:22-bookworm-slim@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5 AS nodedeps
-
-# prettier lives outside /src so that a `COPY . .` of the repo cannot
-# overwrite it, and so that node_modules never appears in the tree
-# prettier is about to walk.
-WORKDIR /tools
-
-# package.json pins the version and yarn.lock pins the bytes:
-# --frozen-lockfile installs exactly the lockfile's resolution and fails
-# if package.json disagrees with it, so the tool cannot float between
-# runs. yarn is the one in the image above.
-COPY package.json yarn.lock ./
-RUN yarn install --frozen-lockfile --non-interactive --no-progress
-
-ENV PATH="/tools/node_modules/.bin:${PATH}"
-
-WORKDIR /src
-
-# Read-only markdown check. Must match $stage in
-# script/fmt-check-markdown.
-FROM nodedeps AS fmt-check
-
-COPY . .
-
-# --config, not discovery: a .prettierrc that failed to arrive would
-# otherwise leave prettier on its defaults, where proseWrap is "preserve"
-# and every wrap this check exists to enforce passes. Missing the file is
-# a hard error instead. --no-editorconfig so that .prettierrc alone sets
-# the style.
-RUN prettier --config .prettierrc --no-editorconfig --check "**/*.md"
-
-# Write path. Not a check: script/fmt builds this and takes the files.
-FROM nodedeps AS fmt
-
-COPY . .
-
-RUN prettier --config .prettierrc --no-editorconfig --write "**/*.md"
-
-# Only the markdown leaves, with its paths intact, so that the export
-# below cannot put anything else back over the caller's working tree.
-RUN mkdir -p /out && cd /src && \
-    find . -name '*.md' -type f -exec cp --parents '{}' /out/ ';'
-
-# Export target: `docker build --target fmt-out --output type=local`
-# writes /out's tree into a directory on the client, which is how
-# script/fmt gets formatted markdown back without a bind mount.
-# Must match $stage in script/fmt.
-FROM scratch AS fmt-out
-COPY --from=fmt /out/ /

Dockerfile.lint

@@ -1,29 +0,0 @@
-# Lint-only image: used by script/lint. golangci-lint is never run on
-# the host — the repo is COPYed into the build context and the linter
-# runs as a build step, so a successful build IS a clean lint. This
-# also works where the docker daemon is remote and bind mounts are
-# impossible.
-#
-# `golangci-lint config verify` is deliberately NOT run here: it
-# fetches its JSON schema over a live, unpinned HTTPS call, which would
-# make linting network-dependent and defeat hash-pinning. The cost of
-# that: unknown top-level keys in .golangci.yml are silently ignored,
-# so a mistyped or wrong-schema key lints clean while applying nothing.
-#
-# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-10
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS deps
-
-WORKDIR /src
-
-# Dependencies first, so this stage stays cached across lint runs.
-COPY go.mod go.sum ./
-RUN go mod download
-
-# Everything below is invalidated on every run by the
-# --no-cache-filter=lint that script/lint passes: caching is explicitly
-# waived for linting, and a cached build lints nothing.
-FROM deps AS lint
-
-COPY . .
-
-RUN golangci-lint run --config .golangci.yml ./...

Makefile

@@ -2,9 +2,9 @@
 
 BINARY := dnswatcher
 # VERSION given on the command line (`make build VERSION=...`) or in the
-# environment, which is how the Dockerfile's VERSION build arg arrives,
-# wins over what `git describe` says of this checkout. An empty one counts
-# as not given; `override` is what replaces an empty command-line value.
+# environment wins over what `git describe` says of this checkout. An
+# empty one counts as not given; `override` is what replaces an empty
+# command-line value.
 ifeq ($(VERSION),)
 override VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
 endif
@@ -25,7 +25,7 @@ setup:
 build:
 	go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/dnswatcher
 
-# Prints the version `make build` stamps; the Dockerfile checks it.
+# Prints the version `make build` stamps.
 version:
 	@echo "$(VERSION)"
 

README.md

@@ -73,9 +73,21 @@ notification endpoint set, changes show only on the dashboard; see
   to discover all authoritative nameservers (NS records) for each domain.
 - Queries **every** discovered authoritative nameserver independently.
 - Stores the domain's NS record set, as its parent zone's servers delegate it,
-  and the IPv4 and IPv6 addresses each nameserver's name resolves to.
+  and the IPv4 and IPv6 addresses each nameserver's name resolves to. The set is
+  only ever the domain's own delegation. A domain whose parent zone's servers
+  answer NXDOMAIN, that it does not exist, has no nameservers and is shown as
+  not existing (see Web Dashboard and HTTP API). A domain that exists but has no
+  delegation of its own, such as `octocat.github.io`, has no nameservers either.
+  When the parent zone's servers do not answer, the check fails and the set from
+  the previous check is kept.
 - Any change triggers a notification:
-    - NS added to or removed from that set.
+    - NS added to or removed from that set. A domain that had nameservers on the
+      previous check and no longer exists gets one with all of them removed.
+      After an upgrade, a domain with no delegation of its own, for which an
+      earlier version saved its parent zone's nameservers, also gets one with
+      all of them removed, on its first check. That one does not mean the domain
+      stopped existing: it is not shown as not existing, and its records are
+      still watched.
     - NS address change: a nameserver that stays in the set resolves to
       different addresses than on the previous check. A nameserver added or
       removed gets only the NS change notification. When the lookup of a
@@ -87,7 +99,11 @@ notification endpoint set, changes show only on the dashboard; see
   records, stored per nameserver. Their changes are notified as a hostname's
   are, as a record change, NS query failure, NS recovery, inconsistency or CNAME
   address change, in a message that starts `Domain:` where a hostname's starts
-  `Hostname:`.
+  `Hostname:`. A domain listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no
+  record change or inconsistency notification. A domain with no delegation of
+  its own has these records asked at the servers of the zone it is in, as a
+  hostname has. A domain that does not exist has none: they are not asked for,
+  and those saved by an earlier check are removed without a notification.
 
 ### DNS Hostname Monitoring (Subdomains)
 
@@ -95,7 +111,11 @@ notification endpoint set, changes show only on the dashboard; see
   via the Public Suffix List).
 - Every **1 hour** by default, performs a full iterative trace to discover the
   authoritative nameservers of the zone the hostname is in, which is not always
-  its last two labels (a name under `co.uk`, or in a delegated subdomain).
+  its last two labels (a name under `co.uk`, or in a delegated subdomain). The
+  trace moves from a name to its parent only when the servers asked answer that
+  the name has no delegation of its own, or does not exist. When they do not
+  answer, the check fails and the hostname's records from the previous check are
+  kept.
 - Queries **each** authoritative nameserver independently for **all** record
   types: A, AAAA, CNAME, MX, TXT, SRV, CAA, NS.
 - Each record type is a query of its own. When a nameserver answers some types
@@ -117,10 +137,14 @@ notification endpoint set, changes show only on the dashboard; see
   lower case, because names are case-insensitive and nameservers may answer in
   any letter case. TXT and CAA values keep their letter case; they are not
   lower-cased.
-- Any observable change in any nameserver's response triggers a notification.
-  This includes:
+- Any observable change in any nameserver's response triggers a notification,
+  except a record change or an inconsistency for a domain or hostname listed in
+  `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS`. This includes:
     - **Record change**: A nameserver returns different records than it did on
-      the previous check (additions, removals, value changes).
+      the previous check (additions, removals, value changes). For a domain or
+      hostname listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS`, neither a
+      record change nor an inconsistency is notified; its records are still
+      checked and saved, and its other notifications are sent.
     - **NS query failure**: A nameserver that previously responded becomes
       unreachable (timeout, SERVFAIL, REFUSED, network error). This is distinct
       from "responded with no records": a nameserver that answers NXDOMAIN or
@@ -141,7 +165,8 @@ notification endpoint set, changes show only on the dashboard; see
       failed on it, and answers differently is reported on the check where it
       answers. So is a pair that differs in a record type whose query to either
       nameserver failed on the previous check. If a pair agrees again and later
-      disagrees, the alert is sent again.
+      disagrees, the alert is sent again. For a domain or hostname listed in
+      `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS`, no inconsistency is notified.
     - **CNAME address change**: The addresses at the end of a name's CNAME chain
       differ from those of the previous check. They are found when its
       nameservers answer with a CNAME and no address; a name that answers with
@@ -167,9 +192,13 @@ notification endpoint set, changes show only on the dashboard; see
 - Any change in port availability triggers a notification:
     - Port transitioned from open to closed (or vice versa).
     - New IP appeared (from DNS change): its port state is recorded without a
-      port notification; the DNS change notification shows the new address.
+      port notification; the DNS change notification shows the new address. A
+      domain or hostname listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets
+      no notification for an address added to its own A or AAAA records.
     - IP disappeared (from DNS change) — noted in the DNS change notification;
-      port state for that IP is removed. When none of a name's nameservers
+      port state for that IP is removed. A domain or hostname listed in
+      `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no notification for an address
+      removed from its own A or AAAA records. When none of a name's nameservers
       answered, its addresses are not known, so the port state saved for them is
       kept.
 
@@ -191,7 +220,9 @@ notification endpoint set, changes show only on the dashboard; see
 
 **Every observable state change produces a notification.** dnswatcher is
 designed as a real-time change feed — degradations, failures, recoveries, and
-routine changes are all reported equally.
+routine changes are all reported equally. A domain or hostname listed in
+`DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no record change or inconsistency
+notification.
 
 Supported notification backends:
 
@@ -216,7 +247,9 @@ includes:
 - **NS recoveries**: Which nameserver recovered, which hostname/domain.
 - **NS inconsistencies**: Which nameservers disagree, what each one returned,
   which hostname or domain affected.
-- **Port changes**: Which IP:port, its new state, all associated hostnames.
+- **Port changes**: Which IP:port, its new state, and the domains and the
+  hostnames that resolve to it, on a `Domains:` line and a `Hostnames:` line. A
+  line that would name nothing is left out.
 - **TLS expiry warnings**: Expiry date and days remaining, CN, associated
   hostname and IP.
 - **TLS certificate changes**: Old and new CN and issuer, associated hostname
@@ -243,6 +276,14 @@ clears them.
   false-positive change notifications.
 - State is written atomically (write to temp file, then rename) to prevent
   corruption.
+- A name removed from `DNSWATCHER_TARGETS` is removed from the state at startup,
+  before the first check, without a notification: its domain, hostname and
+  certificate entries go, it is taken off each port entry's list of names, and a
+  port entry left with no name goes, so the dashboard and `/api/v1/status` no
+  longer list or count it. The first check's port checks remove the port entries
+  of addresses no configured name has.
+- Each port check also removes the certificate entries for an address their name
+  no longer resolves to, except while none of the name's nameservers answer.
 
 ### Web Dashboard
 
@@ -250,11 +291,13 @@ dnswatcher includes an unauthenticated, read-only web dashboard at the root URL
 (`/`). It displays:
 
 - **Summary counts** for monitored domains, hostnames, ports, and certificates.
-- **Domains** with their discovered nameservers, and each domain's own records
-  per nameserver and status, shown as a hostname's are.
+- **Domains** with their discovered nameservers, or "does not exist" for a
+  domain whose parent zone's servers answered NXDOMAIN, and each domain's own
+  records per nameserver and status, shown as a hostname's are.
 - **Hostnames** with per-nameserver DNS records and status. For a nameserver
   whose query failed, the reason is shown in place of the records.
-- **Ports** with open/closed state and associated hostnames.
+- **Ports** with open/closed state and the domains and hostnames that resolve to
+  each address, in separate columns.
 - **TLS certificates** with CN, issuer, expiry, and status. For a failed check,
   the reason is shown in place of CN, issuer and expiry.
 - **Recent alerts** (last 100 notifications sent since the process started),
@@ -287,7 +330,11 @@ In `/api/v1/status`, each nameserver entry and certificate entry whose `status`
 is `error` also has `error`, the reason, as in the state file (see State File
 Format). A domain's own records are in its entry in `domains`, under
 `recordsByNameserver`, in the form a hostname's entry in `hostnames` has them
-under `nameservers`; `hostnames` and `counts.hostnames` hold no domain.
+under `nameservers`; `hostnames` and `counts.hostnames` hold no domain. A domain
+entry's `nxdomain` is `true` when the domain's parent zone's servers answered
+NXDOMAIN, that it does not exist; its `nameservers` and `recordsByNameserver`
+are then empty. A port entry lists the domains that resolve to its address in
+`domains`, and the hostnames in `hostnames`.
 
 `/metrics` is served only when `DNSWATCHER_METRICS_USERNAME` is set, behind
 Basic Auth. It has the Prometheus Go client's default metrics only (Go runtime,
@@ -374,23 +421,24 @@ following precedence (highest to lowest):
 
 ### Environment Variables
 
-| Variable                            | Description                                                                                                 | Default               |
-| ----------------------------------- | ----------------------------------------------------------------------------------------------------------- | --------------------- |
-| `PORT`                              | HTTP listen port                                                                                            | `8080`                |
-| `DNSWATCHER_DEBUG`                  | Enable debug logging                                                                                        | `false`               |
-| `DNSWATCHER_DATA_DIR`               | Directory for state file                                                                                    | `/var/lib/dnswatcher` |
-| `DNSWATCHER_TARGETS`                | Comma-separated DNS names (auto-classified via PSL)                                                         | `""`                  |
-| `DNSWATCHER_SLACK_WEBHOOK`          | Slack incoming webhook URL                                                                                  | `""`                  |
-| `DNSWATCHER_MATTERMOST_WEBHOOK`     | Mattermost incoming webhook URL                                                                             | `""`                  |
-| `DNSWATCHER_NTFY_TOPIC`             | ntfy topic URL                                                                                              | `""`                  |
-| `DNSWATCHER_DNS_INTERVAL`           | DNS check interval, a positive duration such as `30m`; empty means the default, anything else stops startup | `1h`                  |
-| `DNSWATCHER_TLS_INTERVAL`           | TLS check interval, a positive duration such as `6h`; empty means the default, anything else stops startup  | `12h`                 |
-| `DNSWATCHER_TLS_EXPIRY_WARNING`     | Days before expiry to warn                                                                                  | `7`                   |
-| `DNSWATCHER_SENTRY_DSN`             | Sentry DSN for error reporting                                                                              | `""`                  |
-| `DNSWATCHER_MAINTENANCE_MODE`       | Only sets `maintenanceMode` in the health check response; changes nothing else                              | `false`               |
-| `DNSWATCHER_METRICS_USERNAME`       | Basic auth username for /metrics, which is served only when this is set                                     | `""`                  |
-| `DNSWATCHER_METRICS_PASSWORD`       | Basic auth password for /metrics                                                                            | `""`                  |
-| `DNSWATCHER_SEND_TEST_NOTIFICATION` | Send a test notification after first scan completes                                                         | `false`               |
+| Variable                               | Description                                                                                                                           | Default               |
+| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
+| `PORT`                                 | HTTP listen port                                                                                                                      | `8080`                |
+| `DNSWATCHER_DEBUG`                     | Enable debug logging                                                                                                                  | `false`               |
+| `DNSWATCHER_DATA_DIR`                  | Directory for state file                                                                                                              | `/var/lib/dnswatcher` |
+| `DNSWATCHER_TARGETS`                   | Comma-separated DNS names (auto-classified via PSL)                                                                                   | `""`                  |
+| `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` | Comma-separated names from `DNSWATCHER_TARGETS` for which no record change or inconsistency is notified; any other name stops startup | `""`                  |
+| `DNSWATCHER_SLACK_WEBHOOK`             | Slack incoming webhook URL                                                                                                            | `""`                  |
+| `DNSWATCHER_MATTERMOST_WEBHOOK`        | Mattermost incoming webhook URL                                                                                                       | `""`                  |
+| `DNSWATCHER_NTFY_TOPIC`                | ntfy topic URL                                                                                                                        | `""`                  |
+| `DNSWATCHER_DNS_INTERVAL`              | DNS check interval, a positive duration such as `30m`; empty means the default, anything else stops startup                           | `1h`                  |
+| `DNSWATCHER_TLS_INTERVAL`              | TLS check interval, a positive duration such as `6h`; empty means the default, anything else stops startup                            | `12h`                 |
+| `DNSWATCHER_TLS_EXPIRY_WARNING`        | Days before expiry to warn                                                                                                            | `7`                   |
+| `DNSWATCHER_SENTRY_DSN`                | Sentry DSN for error reporting                                                                                                        | `""`                  |
+| `DNSWATCHER_MAINTENANCE_MODE`          | Only sets `maintenanceMode` in the health check response; changes nothing else                                                        | `false`               |
+| `DNSWATCHER_METRICS_USERNAME`          | Basic auth username for /metrics, which is served only when this is set                                                               | `""`                  |
+| `DNSWATCHER_METRICS_PASSWORD`          | Basic auth password for /metrics                                                                                                      | `""`                  |
+| `DNSWATCHER_SEND_TEST_NOTIFICATION`    | Send a test notification after first scan completes                                                                                   | `false`               |
 
 **`DNSWATCHER_TARGETS` is required.** dnswatcher will refuse to start if no
 monitoring targets are configured. A monitoring daemon with nothing to monitor
@@ -575,6 +623,11 @@ nothing for it. Both lists are left out when empty.
 resolves to. A state file without it loads, and the next check fills it in
 without a notification.
 
+A domain entry has `"nxdomain": true` when the domain's parent zone's servers
+answered NXDOMAIN, that it does not exist. Its `nameservers` and
+`nameserverAddresses` are then empty, and `hostnames` holds no entry for it.
+`nxdomain` is left out when false.
+
 `cnameAddresses` lists the sorted addresses at the end of the chain of every
 CNAME target a hostname's nameservers gave, found when they answered with a
 CNAME and no address; it is empty when they answered with an address. When a
@@ -583,8 +636,9 @@ for A, AAAA and CNAME, the previous check's list is kept, or `null` when no
 earlier check saved one. A state file without it loads, and the first check
 after that saves it without a notification.
 
-A port entry in the older format, with one `hostname` instead of the `hostnames`
-list, loads as a list of that one name.
+A port entry's `hostnames` lists every name that resolves to its address,
+domains included. A port entry in the older format, with one `hostname` instead
+of the `hostnames` list, loads as a list of that one name.
 
 ---
 
@@ -602,48 +656,42 @@ provide:
 - `script/setup` — make a fresh clone ready for development: bootstrap plus the
   git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker image tag)
-- `script/test` — run the test suite (race detector, coverage). Caching is
-  waived for testing, exactly as it is for linting: `-count=1` forces every
-  invocation to execute, because the suite queries live DNS and a cached pass
-  queries nothing. Failures are rerun with `-v` automatically, and the build
+- `script/test` — run the test suite (race detector, coverage) by building the
+  `Dockerfile`'s test phase, which queries live DNS. `-count=1` keeps Go's test
+  result cache out. Failures are rerun with `-v` automatically, and the build
   fails even if that rerun passes.
-- `script/lint` — run golangci-lint, always inside Docker: it builds
-  `Dockerfile.lint`, which COPYs the repo into the digest-pinned `golangci-lint`
-  image and lints as a build step, so a successful build is a clean lint. The
-  linter is never installed or run on the host, and Docker is the only
-  prerequisite. Caching is waived for linting: the lint stage is forced to
-  execute on every run with `--no-cache-filter`, because a cached build lints
-  nothing.
+- `script/lint` — run golangci-lint by building the `Dockerfile`'s lint phase,
+  on the digest-pinned `golangci-lint` image, so a successful build is a clean
+  lint. The linter is never installed or run on the host, and Docker is the only
+  prerequisite.
 - `script/fmt` — format all code (gofmt -s, goimports) and all Markdown
   (prettier). goimports runs with `go run` at a pinned commit, never from your
-  `PATH`. prettier runs inside Docker, built from `Dockerfile.fmt` on a
+  `PATH`. prettier runs inside Docker, in a stage of the `Dockerfile` on a
   digest-pinned node image, at the version pinned by `package.json` and
   `yarn.lock`; it is never installed on the host.
 - `script/fmt-check` — check formatting (read-only) with the same tools, failing
-  on any file `script/fmt` would change. It runs the two scripts below.
-- `script/fmt-check-go` — the gofmt and goimports half, on the host. The
-  `Dockerfile` lint stage runs it.
-- `script/fmt-check-markdown` — the prettier half, inside Docker, forced to
-  execute on every run with `--no-cache-filter`
+  on any file `script/fmt` would change: gofmt and goimports on the host,
+  prettier inside Docker
 - `script/check` — run test, lint, and fmt-check
 - `script/docker` — build the Docker image tagged via `script/projectname`, with
-  `--no-cache-filter=lint,builder` so the lint stage and the builder stage,
-  which runs the tests, run on every invocation, and with the version from
-  `git describe` passed as `--build-arg VERSION`
-- `script/cibuild` — CI entrypoint: `docker build` with
-  `--no-cache-filter=lint,builder`, so the lint stage and the builder stage,
-  which runs the tests, run on every invocation, because a cached build lints
-  nothing and queries no DNS; then `script/fmt-check-markdown`
+  the version from `git describe` passed as `--build-arg VERSION`
+- `script/cibuild` — CI entrypoint: `script/bootstrap`, then `script/check`,
+  then the image build `script/docker` does, which runs the lint and test phases
+  again
 - `script/precommit` — run by the git pre-commit hook; `go mod tidy` guard, then
   `script/check`
 - `script/install-precommit` — install the git pre-commit hook
 
+Linting and testing are phases of the `Dockerfile`, and the image is built only
+when both pass. Every `docker build` in `script/` passes `--no-cache`, because a
+cached build lints nothing and queries no DNS.
+
 ## Building
 
 ```sh
 make build      # Build binary to bin/dnswatcher
 make version    # Print the version make build stamps
-make test       # Run tests with race detector
+make test       # Run tests with race detector in Docker (requires docker)
 make lint       # Run golangci-lint in Docker (requires docker)
 make fmt        # Format code and Markdown (requires docker)
 make check      # Run all checks (test, lint, fmt-check)
@@ -658,21 +706,20 @@ the environment, otherwise from `git describe --tags --always --dirty`, and
 `dev` without git metadata. An empty `VERSION` counts as not given. The version
 appears in the startup log and in the health check response.
 
-The image takes it the same way, from the `.git` the build context carries, so a
-plain `docker build .` of a clone stamps the commit it was built from; a clone
-without tags stamps the short commit. A clone made with `--depth 1` carries at
-most a tag on its own commit, so such a clone of an untagged commit stamps the
-short commit. In a build from a directory, `.dockerignore` keeps out
-`.git/config`, which `git describe` does not need and which can hold a
-credential. Docker does not apply `.dockerignore` to a context sent as a tar
-archive, as upaas sends it, so that context carries `.git/config` into the
-build. It also keeps its files' owners, so git in the build trusts the checkout
-whoever owns it. A non-empty `--build-arg VERSION=...` takes precedence;
-`make docker` passes the version `git describe` gives on the host. The build
-fails when the context carries `.git`, as a directory or as a file, and the
-version comes out empty, `dev` or `unknown`. `.dockerignore` must list no
-tracked file: git in the build would see it as deleted and mark the version
-`-dirty`.
+The image takes it from `git describe --tags --always` on the `.git` the build
+context carries, so a plain `docker build .` of a clone stamps the commit it was
+built from; a clone without tags stamps the short commit. A clone made with
+`--depth 1` carries at most a tag on its own commit, so such a clone of an
+untagged commit stamps the short commit. In a build from a directory,
+`.dockerignore` keeps out `.git/config` and every submodule's git config, which
+`git describe` does not need and which can hold a credential. Docker does not
+apply `.dockerignore` to a context sent as a tar archive, as upaas sends it, so
+that context carries `.git/config` into the build. It also keeps its files'
+owners, so git in the build trusts the checkout whoever owns it. A non-empty
+`--build-arg VERSION=...` takes precedence; `make docker` passes the version
+`git describe` gives on the host. The build fails when the context carries
+`.git`, as a directory or as a file, and the version comes out empty, `dev` or
+`unknown`.
 
 ---
 
@@ -728,7 +775,8 @@ docker run -d \
 1. **Startup**: Check that the data directory can be written, and exit with an
    error naming it if not. Load state from disk. If no state file exists, start
    with empty state (first check will establish baseline without triggering
-   change notifications).
+   change notifications). Remove from the state the names no longer in
+   `DNSWATCHER_TARGETS` (see State Management).
 2. **Initial check**: Immediately perform all DNS, port, and TLS checks on
    startup.
 3. **Periodic checks** (DNS always runs first):
@@ -744,7 +792,9 @@ docker run -d \
       nameservers answered, the addresses an earlier check found at the end of
       the chain are used.
 4. **On change detection**: Send notifications to all configured endpoints,
-   update in-memory state, persist to disk.
+   update in-memory state, persist to disk. A record change or inconsistency for
+   a domain or hostname listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` sends
+   no notification, but the state is still updated and saved.
 5. **Shutdown**: The watcher stops checking and saves the final state to disk,
    and shutdown waits for that save before it goes on. Then it waits for
    in-flight notification deliveries to complete. Both waits share the fx

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-08-07
+last_modified: 2026-10-04
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -60,17 +60,28 @@ style conventions are in separate documents:
   prerequisite since nvm requires bash. yarn is then pinned via
   `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
   always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
-  scripts are our own extensions to the standard: `script/check` runs
-  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
-  what the git pre-commit hook runs, and it calls `script/check`;
-  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
-  target shims to it); and `script/projectname` (literally that filename) simply
-  outputs the project's name. Scripts that need the name call
-  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
-  so those scripts stay byte-identical across all repos. Repo-type-specific
-  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
-  `script/precommit`, not in the hook itself. Model scripts are at
+  repo root, runs `script/bootstrap`, runs `script/check`, and builds the image
+  with the version; the Gitea workflow calls it. **`script/cibuild` runs
+  `script/bootstrap` first**, because the workflow checks out the repo and runs
+  nothing else, while `script/fmt-check` runs the formatter on the host: on a
+  pristine checkout with nothing installed the run dies there, after the
+  containerised gates have passed. **The bootstrap alone is not enough**:
+  `script/bootstrap` installs node and yarn under nvm and leaves neither on the
+  `PATH` of the shell that called it, so a bare `yarn` still exits 127. The host
+  entrypoints that need yarn — `script/fmt` and `script/fmt-check` — therefore
+  source nvm for the pinned node version before invoking it, exactly as
+  `script/bootstrap`'s own install step does. A runner carrying nothing but
+  docker and git then gets through `script/check`. Four further scripts are our
+  own extensions to the standard: `script/check` runs `script/test`,
+  `script/lint` and `script/fmt-check`; `script/precommit` is what the git
+  pre-commit hook runs, and it calls `script/check`; `script/install-precommit`
+  installs the git pre-commit hook (the `make hooks` target shims to it); and
+  `script/projectname` (literally that filename) simply outputs the project's
+  name. Scripts that need the name call `script/projectname` — e.g.
+  `script/docker` assembles its image tag from it — so those scripts stay
+  byte-identical across all repos. Repo-type-specific pre-commit extras (e.g.
+  `go mod tidy` verification in Go repos) belong in `script/precommit`, not in
+  the hook itself. Model scripts are at
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
   must document the provided scripts in an **Entrypoints** section (see the
   README requirements below).
@@ -89,87 +100,198 @@ style conventions are in separate documents:
   contributor should be able to understand the entire development workflow by
   reading the Makefile.
 
-- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
-  as a build step so the build fails if the branch is not green. For non-server
-  repos, the Dockerfile should bring up a development environment and run
-  `make check`. For server repos, `make check` should run as an early build
-  stage before the final image is assembled. Dockerfiles install development
-  prerequisites by running `script/bootstrap` rather than duplicating installs
-  inline; COPY `script/` and the dependency manifests (`package.json` +
-  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
-  layer stays cached until dependencies change.
+- Every repo should have a `Dockerfile`, and it carries the repo's gates: a
+  `lint` phase and a `test` phase, with the final stage depending on both so the
+  image cannot be built unless they pass. For non-server repos the final stage
+  brings up a development environment; for server repos it is the runtime image.
+  The gate phases and the build stage start from their pinned base images and
+  install what those images lack either inline, as the canonical Go `Dockerfile`
+  below does for `git`, or by running `script/bootstrap`, as the `prompts`
+  repo's own `Dockerfile` does for its yarn packages. The development
+  environment stage installs development prerequisites by running
+  `script/bootstrap` rather than duplicating its installs inline. A stage that
+  runs `script/bootstrap` COPYs `script/` and the dependency manifests
+  (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it.
 
-- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
-  repos use a multistage build where linting runs in an independent stage based
-  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
-  `make fmt-check` and `make lint` before the full build begins. The build stage
-  then declares an explicit dependency on the lint stage via
-  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
-  linting before proceeding to compilation and tests. This ensures lint failures
-  surface in seconds rather than minutes, without blocking on dependency
-  download or compilation in the build stage.
+- **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is
+  no separate lint file. `script/lint` and `script/test` each build one phase
+  and nothing else:
 
-    The standard pattern for a Go repo Dockerfile is:
+    ```sh
+    docker build --no-cache --target lint -t "$(script/projectname)-lint" .
+    docker build --no-cache --target test -t "$(script/projectname)-test" .
+    ```
+
+    **A stage that is not the last one in the file is built only when the final
+    stage's chain depends on it, or when `--target` names it.** That is why the
+    two gates are always invoked by name here, and why the final stage carries a
+    `COPY --from=` of a harmless file from each of them: without that edge a
+    plain `docker build .` builds the last stage alone and exits 0 having linted
+    and tested nothing.
+
+    **Every `docker build` in `script/` is tagged**, here and in
+    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
+    image behind on every invocation, on every developer host and every CI
+    runner; a tagged one replaces the previous image.
+
+    Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
+    `eslint`, `prettier` — never through `make lint` or `script/test`, which are
+    themselves a `docker build` and would recurse into a daemon that does not
+    exist in a build step. Formatting is the exception and stays on the host:
+    `script/fmt` writes the working tree, and `script/fmt-check` is its
+    read-only twin.
+
+    **No lint verdict may come from a host invocation of the linter.** On a
+    shared host golangci-lint reads a result cache keyed on file content rather
+    than location, so a second checkout of the same content is served the first
+    one's findings, and a host-global lock in `$TMPDIR` makes concurrent runs
+    exit non-zero with `parallel golangci-lint is running` — a status a caller
+    cannot tell from real findings. Both have produced wrong verdicts in this
+    org, in both directions. A container has its own cache, its own `TMPDIR` and
+    a digest-pinned binary, so neither is reachable.
+
+- **Any build that runs checks is built with `--no-cache`.** Docker invalidates
+  a `COPY` layer only when the copied content changes, so on an unchanged tree
+  the check `RUN` is served from cache, nothing executes, and the build still
+  exits 0. Every `docker build` in `script/` therefore passes `--no-cache`:
+  `script/lint`, `script/test`, `script/cibuild` and `script/docker` are the
+  four, and there is no fifth — `script/check` runs the two gate phases and
+  `script/fmt-check`, and builds no image of its own. A bare `docker build .` is
+  not evidence that anything ran: a sub-second build reporting success is a
+  cache hit, not a result. Never invalidate by pruning — `docker builder prune`
+  and friends destroy a build cache shared with every other build on the host.
+  When a check is added or changed, prove it works by planting a defect it must
+  catch and watching the run fail on it, then revert the defect. A green run
+  alone shows neither that the check ran nor that it covers what it should.
+
+- **The gate phases are separate stages, and the build stage depends on both.**
+  The lint phase is based on the `golangci/golangci-lint` image (pinned by
+  hash), so lint failures surface in seconds rather than after a full compile,
+  and the test phase is based on the Debian Go image. The canonical Go repo
+  `Dockerfile`:
 
     ```dockerfile
-    # Lint stage — fast feedback on formatting and lint issues
+    # Lint phase
     # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
     FROM golangci/golangci-lint@sha256:... AS lint
     WORKDIR /src
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    RUN make fmt-check
-    RUN make lint
+    RUN golangci-lint run --config .golangci.yml ./...
 
-    # Build stage
-    # golang:1.x-alpine, YYYY-MM-DD
-    FROM golang@sha256:... AS builder
+    # Test phase. -race needs cgo and so a C compiler, which the Debian Go
+    # image ships and the alpine one does not.
+    # golang:1.x, YYYY-MM-DD
+    FROM golang@sha256:... AS test
     WORKDIR /src
-
-    # Force BuildKit to run the lint stage before proceeding
-    COPY --from=lint /src/go.sum /dev/null
-
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    RUN make test
+    RUN go test -timeout 90s -race -cover ./... || \
+        { echo "--- Rerunning with -v for details ---"; \
+          go test -timeout 90s -race -v ./...; exit 1; }
 
-    ARG VERSION=dev
-    RUN CGO_ENABLED=0 go build -trimpath \
-        -ldflags="-s -w -X main.Version=${VERSION}" \
-        -o /app ./cmd/app/
+    # Build stage. Nothing is wanted from either phase above; the copies
+    # are what make BuildKit build them first, so this stage cannot run
+    # unless lint and test passed.
+    # golang:1.x-alpine, YYYY-MM-DD
+    FROM golang@sha256:... AS builder
+    COPY --from=lint /src/go.sum /dev/null
+    COPY --from=test /src/go.sum /dev/null
+    RUN apk add --no-cache git
+    # A tar-stream context keeps the sender's file owners, which git refuses.
+    RUN git config --system --add safe.directory /src
+    WORKDIR /src
+    COPY go.mod go.sum ./
+    RUN go mod download
+    COPY . .
 
-    # Runtime stage
+    # The VERSION build arg when one is given, otherwise
+    # `git describe --tags --always` on the .git in the build context. With
+    # .git present, a version that is still empty, dev or unknown fails the
+    # build: git is missing or could not read the checkout.
+    ARG VERSION
+    RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
+        if [ -e .git ]; then \
+            case "$VERSION" in ""|dev|unknown) \
+                echo "version is '$VERSION' although .git is present" >&2; \
+                exit 1 ;; \
+            esac; \
+        fi; \
+        CGO_ENABLED=0 go build -trimpath \
+            -ldflags="-s -w -X main.Version=${VERSION}" \
+            -o /app ./cmd/app/
+
+    # Runtime stage, and the last one
     FROM alpine@sha256:...
     COPY --from=builder /app /usr/local/bin/app
     ENTRYPOINT ["app"]
     ```
 
     Key points:
-    - The lint stage uses the `golangci/golangci-lint` image directly (it
-      includes both Go and the linter), so there is no need to install the
-      linter separately.
-    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
-      a stage dependency. BuildKit runs stages in parallel by default; without
-      this line, the build stage would not wait for lint to finish and a lint
-      failure might not fail the overall build.
+    - The lint phase uses the `golangci/golangci-lint` image directly (it has
+      both Go and the linter), so nothing needs installing.
+    - `COPY --from=<phase> /src/go.sum /dev/null` is a no-op copy whose only
+      purpose is the ordering edge. BuildKit runs stages in parallel by default,
+      and a stage nothing depends on is not built at all, so without these two
+      lines a red gate would not fail the build.
+    - Keep the runtime stage last, and if you add a stage after it, give it the
+      same two copies. A plain `docker build .` builds the last stage's chain
+      and nothing else.
     - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint stage must
+      (e.g. a web frontend compiled in a separate stage), the lint phase must
       create placeholder files so the embed directives resolve. Example:
       `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-      The lint stage should not depend on the actual build output — it exists to
-      fail fast.
-    - If the project requires CGO or system libraries for linting (e.g.
-      `vips-dev`), install them in the lint stage with `apk add`.
-    - The build stage runs `make test` after compilation setup. Tests run in the
-      build stage, not the lint stage, because they may require compiled
-      artifacts or heavier dependencies.
+    - If the project requires CGO or system libraries for linting, install them
+      in the lint phase. The `golangci/golangci-lint` image is Debian-based and
+      has no `apk`, so install with `apt-get` under the Debian package name
+      (`libvips-dev`, where alpine says `vips-dev`), and delete the package
+      lists in the same `RUN`, so the layer does not keep them:
+
+        ```dockerfile
+        RUN apt-get update \
+            && apt-get install -y --no-install-recommends libvips-dev \
+            && rm -rf /var/lib/apt/lists/*
+        ```
+
+    - `.dockerignore` lets `.git` into the build context. It keeps out every git
+      `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the
+      repository's own, each submodule's under `.git/modules/`, and that of a
+      submodule keeping its own `.git` directory. `git describe` does not need
+      them, and each can hold a credential: a password in a remote URL, or the
+      token the CI checkout step stores there. A submodule whose name has a
+      `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole
+      git directory to `**/.git/modules/**/config`, and Go's version stamping
+      then fails the build: give it a name without that segment
+      (`git submodule add --name`). The stage that compiles has `git` (the
+      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
+      takes the version from the `VERSION` build argument when one is given,
+      otherwise from `git describe --tags --always`. That gives the tag on a
+      tagged commit; on a later commit, the tag, the number of commits since it
+      and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no
+      tag is reachable. The stage that compiles also marks its working directory
+      safe for git (`git config --system --add safe.directory /src`): a context
+      sent as a tar stream keeps the sender's file owners, and git refuses a
+      checkout owned by another user, so the version would come out empty.
+      `ARG VERSION` has no default, and the build fails if the context carries
+      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
+      `docker build .` with no build arguments must succeed; a Dockerfile that
+      refuses an empty build argument drops that refusal and keeps the argument.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` (which runs `docker build .`) on push. Since the
-  Dockerfile already runs `make check`, a successful build implies all checks
-  pass.
+  runs `script/cibuild` on push, and checks out the repo as its only other step.
+  That script bootstraps, runs the gate phases, and then builds the image, so a
+  successful run means every check passed; a bare `docker build .` does not
+  carry the same guarantee, because its gate phases may come from the cache. The
+  image build is uncached and so runs the gate phases a second time. That is the
+  price of the rule above, and it is worth paying: the image that ships is built
+  from a run of its own gates rather than from a cache entry. A separate
+  workflow limited to `main` by a `branches` list under `on: push` cannot be
+  checked by review: to try a change to it, add the feature branch to that list
+  and push, then remove the branch from the list again before merging. Keep any
+  job in it that publishes behind `if: github.ref_name == 'main'`, so the run
+  from the feature branch publishes nothing.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -193,15 +315,17 @@ style conventions are in separate documents:
   suite that exceeds it fails. Under 20 seconds is the target. A suite between
   20 and 60 seconds is still green, but the overage must be filed as an
   improvement bug against that repo. Add a 90-second timeout to the test
-  invocation in the Makefile (`go test -timeout 90s`). The backstop deliberately
-  sits above the hard cap so that it catches a genuinely hung test rather than a
-  merely slow one.
+  invocation (`go test -timeout 90s`). The backstop deliberately sits above the
+  hard cap so that it catches a genuinely hung test rather than a merely slow
+  one.
 
-- **`make test` should use the conditional verbose rerun pattern.** Run tests
-  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
-  show full output. This keeps CI logs and `docker build` output clean on
-  success (just package/suite summaries) while providing full diagnostic detail
-  on failure (every test case, every assertion). The general shell pattern:
+- **The test command should use the conditional verbose rerun pattern.** Run
+  tests without `-v` (verbose) first. If tests fail, automatically rerun with
+  `-v` to show full output. This keeps CI logs and `docker build` output clean
+  on success (just package/suite summaries) while providing full diagnostic
+  detail on failure (every test case, every assertion). The command lives in the
+  `test` phase of the `Dockerfile`, since `script/test` builds that phase; the
+  Makefile form below is the same pattern for any repo-local invocation:
 
     ```makefile
     test:
@@ -214,11 +338,26 @@ style conventions are in separate documents:
 
     ```makefile
     test:
-    	@go test -timeout 90s -race -cover ./... || \
+    	@go test -count=1 -timeout 90s -race -cover ./... || \
     		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -timeout 90s -race -v ./...; exit 1; }
+    		  go test -count=1 -timeout 90s -race -v ./...; exit 1; }
     ```
 
+    `-count=1` is required on both invocations: it defeats Go's test _result_
+    cache, so neither run can report a stored pass in place of running the
+    tests. It leaves the build cache alone, so it costs the runtime of the suite
+    and no recompilation.
+
+    That cache is Go's own, separate from Docker's layer cache. Go stores a
+    passing result in its cache directory (`GOCACHE`), and when the same tests
+    run again on unchanged code it prints that result, marked `(cached)`,
+    without running them. That matters on a developer's machine, where this
+    target runs and the directory lasts from one run to the next. The `test`
+    phase of the `Dockerfile` needs no `-count=1`: its base image holds no
+    result for this repo's tests and nothing before its `go test` step runs a
+    test, so there is nothing to replay. `--no-cache` (above) is what makes that
+    step run on an unchanged tree.
+
     Python example:
 
     ```makefile
@@ -244,10 +383,84 @@ style conventions are in separate documents:
   must be in `.gitignore`. No exceptions.
 
 - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
-  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
-  Fetch the standard `.gitignore` from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
-  a new repo.
+  editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`),
+  language build artifacts, and `node_modules/`. Fetch the standard `.gitignore`
+  from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when
+  setting up a new repo. These patterns are written to `.gitignore`'s own
+  semantics, in which an unanchored pattern already matches at every depth; they
+  are not a `.dockerignore` and must not be transplanted into one unmodified.
+
+- **`.dockerignore` does not use `.gitignore` semantics, and copying patterns
+  across unmodified leaves secrets in the build context.** Docker matches with
+  `moby/patternmatcher`: `filepath.Match` semantics plus a `**` extension, so
+  `*` does not cross `/` and a pattern without a leading `**/` is anchored at
+  the build-context root. A `.dockerignore` listing `.env`, `*.pem` and `*.key`
+  therefore excludes only the copies at the repository root, while `config/.env`
+  and `certs/server.key` still reach the context and can land in an image layer
+  — which is more dangerous than a short file with no secret patterns at all,
+  because it reads as solved and stops anyone looking. Give every
+  depth-independent pattern the `**/` prefix and leave only genuinely
+  root-anchored entries unprefixed: `.claude`, and the repo's own host-built
+  binary, written `/myapp` and never `**/myapp`, which would also match
+  `cmd/myapp/` and delete the package directory from the context. Matching is
+  case-sensitive, and an ALL-CAPS twin per pattern still misses `Server.Key`, so
+  secret names use character ranges — `**/*.[kK][eE][yY]`, `**/*.[pP][eE][mM]`,
+  and likewise for `.envrc` and the extensionless SSH keys. Where such a pattern
+  also catches something the build needs, re-include it with a negation
+  (`!docs/example.env`); deleting the pattern reopens the exposure for every
+  other file it covers. Fetch the standard `.dockerignore` from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore` and extend
+  it with the repo's own artifacts.
+
+- **In-repo agent scratch belongs in both files, written to each file's own
+  semantics.** `.claude/` holds one worktree per in-flight agent — an entire
+  additional checkout of the repo — so under `COPY . .` the build context
+  inflates by a multiple of the repo and another session's unreviewed work can
+  be copied into an image layer. In `.gitignore` the entry is `.claude/`,
+  unanchored. In `.dockerignore` it is `.claude`, anchored and with **no** `**/`
+  prefix, because the prefixed form would also delete any nested directory of
+  that name from the build. Anchoring carries a known gap that the canonical
+  `.dockerignore` states in its own comment, since consuming repos receive the
+  file and not the tracker: the directory is created in the agent's working
+  directory, so a repo running agents in subdirectories still ships
+  `services/api/.claude/` and must add its own anchored entry there.
+
+- **A plain `docker build .` of a clone stamps the version that
+  `git describe --tags --always` gives**, derived from the `.git` in the build
+  context as the canonical `Dockerfile` above shows. Without its failure check,
+  a missing `git` or an unreadable checkout would leave `-X main.Version=` empty
+  and the build would still exit 0. `script/docker` and `script/cibuild` pass
+  the version they compute on the host; it takes precedence. They do this
+  byte-identically across repos:
+
+    ```sh
+    # Own line: a failing command substitution inside an argument does not
+    # trip `set -e`, so the inline form degrades to an empty constant.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$(script/projectname)" .
+    ```
+
+    `--always` makes an untagged repo yield an abbreviated commit hash rather
+    than failing, and the `[ -n "$version" ]` line is the single place the
+    fallback is applied — a live check that fires on a build from an export with
+    no `.git` and on a repository with no commits yet. Do not fold it into the
+    substitution as `|| echo unknown`, which makes the guard unreachable. The
+    Dockerfile's side is `ARG VERSION` in the stage that compiles, declared
+    there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
+    Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
+    the scripts stay byte-identical. One consequence for CI: the standard
+    checkout action clones shallow and fetches no tags, so a repo that embeds a
+    tag-derived version must set `fetch-depth: 0` on its checkout step.
+
+- **Verify `.dockerignore` by enumerating the image, not by reading the
+  patterns.** Plant files at the root _and_ at least two directories deep, build
+  a probe image that does `COPY . .`, and list what actually landed
+  (`docker run --rm --entrypoint find IMAGE /app`). The `transferring context`
+  size is not a substitute: a nested secret is a few bytes, and BuildKit
+  transfers only the delta from the previous build.
 
 - **No build artifacts in version control.** Code-derived data (compiled
   bundles, minified output, generated assets) must never be committed to the
@@ -263,12 +476,56 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
   feature branch.
 
-- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
-  manually by the user. Fetch from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`. The
-  canonical golangci-lint version is v2.12.2 (released 2026-05-06), installed
-  commit-pinned via
-  `go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5`.
+- `.golangci.yml` is standardized. The vendored copy in a consuming repo must
+  _NEVER_ be modified by an agent: fetch it from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
+  byte-identical, so that no repo can quietly loosen its own linting. Linter
+  configuration changes are made to the canonical copy in the `prompts` repo and
+  reach consuming repos by re-vendoring; an agent may open a PR against
+  canonical, which only the user merges. One list is exempt from byte-identity,
+  because it cannot be written once for every repo: the `deny` list of the
+  `test-support` depguard rule, where a repo names its own test-support packages
+  by full import path. A repo adds entries there and changes nothing else, and a
+  re-vendor carries its entries forward. The canonical golangci-lint version is
+  v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base
+  image
+  (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`,
+  which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go`
+  directive must not name a newer Go minor version than the one golangci-lint
+  was built with, or golangci-lint refuses to lint it: this release lints
+  `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo
+  installs golangci-lint on the host. A repo sets the lint phase digest to the
+  one named here and re-vendors `.golangci.yml` in the same commit, whichever of
+  the two prompted the change: the canonical copy can name linters that an older
+  golangci-lint rejects, and a newer golangci-lint can add linters that
+  `default: all` switches on until the canonical copy disables them.
+
+- **`script/bootstrap` installs a pinned tool by comparing versions, never by
+  testing presence.** An `if ! command -v <tool>; then install; fi` guard tests
+  `PATH` only, so on an already-provisioned machine the pin is inert and a
+  version bump is a silent no-op — while the Dockerfile, installing into a clean
+  image, gets the pinned version, so a local `make check` and `make docker` can
+  disagree about what the tool even is. The canonical form:
+    - compares the installed version against the pin over the **whole** version
+      token; a parser that stops at the first `-` reports `2.12.2` for a host
+      running `2.12.2-rc1` and skips the install;
+    - treats absent, non-zero, empty or unrecognised `--version` output as a
+      mismatch, so the failure direction is a redundant install and never a
+      skipped one;
+    - after installing, re-resolves the binary the way callers do — `hash -r`,
+      then through `PATH`, not through the directory the installer wrote to —
+      and fails naming the resolved path, since an install that a shadowing
+      binary hides succeeds while changing nothing any caller sees;
+    - is actually called, and prints the version on both success paths: a
+      function defined and never invoked has the same exit status and the same
+      empty output as one that worked.
+
+    Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
+
+    A Go tool a repo needs on the host is installed with `go install` pinned to
+    a commit hash (`go install <package>@<commit hash>`). It is never tracked as
+    a `go.mod` tool dependency or through a `tools.go` file, either of which
+    pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.
 
 - When pinning images or packages by hash, add a comment above the reference
   with the version and date (YYYY-MM-DD).
@@ -382,12 +639,14 @@ style conventions are in separate documents:
   settings.
 
 - Avoid putting files in the repo root unless necessary. Root should contain
-  only project-level config files (`README.md`, `Makefile`, `Dockerfile`,
-  `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
-  language-specific config). Everything else goes in a subdirectory. Canonical
-  subdirectory names:
+  only project-level config files (`README.md`, `AGENTS.md`, `Makefile`,
+  `Dockerfile`, `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`,
+  and language-specific config). Everything else goes in a subdirectory.
+  Canonical subdirectory names:
     - `bin/` — executable scripts and tools
-    - `cmd/` — Go command entrypoints
+    - `cmd/` — Go command entrypoints; thin only: one `main.go` per binary whose
+      body is a single call into `internal/` or `pkg/`, no project logic in
+      `cmd/`
     - `configs/` — configuration templates and examples
     - `deploy/` — deployment manifests (k8s, compose, terraform)
     - `docs/` — documentation and markdown (README.md stays in root)
@@ -414,3 +673,7 @@ style conventions are in separate documents:
     - Go: `go.mod`, `go.sum`, `.golangci.yml`
     - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore`
     - Python: `pyproject.toml`
+
+- Guidance for coding agents lives in one `AGENTS.md` at the repository root. It
+  is never committed under a file or directory named after one agent tool, such
+  as `CLAUDE.md` or `.claude/`, and never split into separate memory files.

TESTING.md

@@ -38,7 +38,7 @@ works correctly in production.
   responses
 - **Do not add `-short` flags** to skip slow tests
 - **Do not increase `-timeout`** to hide hanging queries
-- **Do not remove `-count=1` from `script/test`** — Go's test cache replays a
-  previous run's output without querying anything, so a cached pass is not
-  evidence that live resolution works
+- **Do not remove `-count=1` from the test phase of the `Dockerfile`** — Go's
+  test cache replays a previous run's output without querying anything, so a
+  cached pass is not evidence that live resolution works
 - **Do not modify linter configuration** to suppress findings

TODO.md

@@ -19,8 +19,26 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 # Completed Steps
 
+- 2026-10-06: canonical files re-fetched from `sneak/prompts` at `dd4027b`; lint
+  and test are phases of the `Dockerfile`, every scripted build uncached (closes
+  #257).
+- 2026-10-05: a name listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no
+  Record Change or Inconsistency notification; a name listed there that is not
+  in `DNSWATCHER_TARGETS` stops startup (closes #255).
+- 2026-10-02: a nameserver whose query for one record type failed while the
+  others answered with no records is `ok`, not `nodata` (closes #253).
+- 2026-10-02: a domain that does not exist is shown so, with no nameservers; no
+  name gets a parent's nameservers when its own did not answer (closes #222).
+- 2026-10-02: the refused-query test sends one query to four operators' public
+  resolvers in turn until one replies, not eight to one operator (closes #251).
+- 2026-10-02: a name removed from `DNSWATCHER_TARGETS` leaves the state, and so
+  the dashboard and API, at startup, before the first check (closes #223).
 - 2026-10-02: a record type whose query to a nameserver fails keeps its previous
   records and alerts nothing; the other types are still saved (closes #231).
+- 2026-10-02: a Port Change notification lists the port's domains on a
+  `Domains:` line and its hostnames on a `Hostnames:` line (closes #248).
+- 2026-10-02: the dashboard's Ports table and `/api/v1/status` port entries list
+  a port's domains apart from its hostnames (closes #245).
 - 2026-10-02: nameservers a referral names without addresses are looked up,
   three deep at most; `pool.ntp.org`'s nameservers resolve (closes #221).
 - 2026-10-02: an apex domain is not counted or listed as a hostname; its records

internal/config/config.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"slices"
 	"strings"
 	"time"
 
@@ -35,6 +36,10 @@ var ErrInvalidInterval = errors.New(
 	"interval must be a positive duration such as 30m or 1h",
 )
 
+// ErrNotInTargets is returned when DNSWATCHER_SKIP_RECORD_NOTIFICATIONS
+// lists a name that is not in DNSWATCHER_TARGETS.
+var ErrNotInTargets = errors.New("name is not in DNSWATCHER_TARGETS")
+
 // Params contains dependencies for Config.
 type Params struct {
 	fx.In
@@ -45,24 +50,25 @@ type Params struct {
 
 // Config holds application configuration.
 type Config struct {
-	Port                 int
-	Debug                bool
-	DataDir              string
-	Domains              []string
-	Hostnames            []string
-	SlackWebhook         string
-	MattermostWebhook    string
-	NtfyTopic            string
-	DNSInterval          time.Duration
-	TLSInterval          time.Duration
-	TLSExpiryWarning     int
-	SentryDSN            string
-	MaintenanceMode      bool
-	MetricsUsername      string
-	MetricsPassword      string
-	SendTestNotification bool
-	params               *Params
-	log                  *slog.Logger
+	Port                    int
+	Debug                   bool
+	DataDir                 string
+	Domains                 []string
+	Hostnames               []string
+	SkipRecordNotifications []string
+	SlackWebhook            string
+	MattermostWebhook       string
+	NtfyTopic               string
+	DNSInterval             time.Duration
+	TLSInterval             time.Duration
+	TLSExpiryWarning        int
+	SentryDSN               string
+	MaintenanceMode         bool
+	MetricsUsername         string
+	MetricsPassword         string
+	SendTestNotification    bool
+	params                  *Params
+	log                     *slog.Logger
 }
 
 // New creates a new Config instance from environment and config files.
@@ -103,6 +109,7 @@ func setupViper(name string) {
 	viper.SetDefault("DEBUG", false)
 	viper.SetDefault("DATA_DIR", "/var/lib/"+name)
 	viper.SetDefault("TARGETS", "")
+	viper.SetDefault("SKIP_RECORD_NOTIFICATIONS", "")
 	viper.SetDefault("SLACK_WEBHOOK", "")
 	viper.SetDefault("MATTERMOST_WEBHOOK", "")
 	viper.SetDefault("NTFY_TOPIC", "")
@@ -147,25 +154,33 @@ func buildConfig(
 		return nil, err
 	}
 
+	skipRecordNotifications, err := parseSkipRecordNotifications(
+		domains, hostnames,
+	)
+	if err != nil {
+		return nil, err
+	}
+
 	cfg := &Config{
-		Port:                 viper.GetInt("PORT"),
-		Debug:                viper.GetBool("DEBUG"),
-		DataDir:              viper.GetString("DATA_DIR"),
-		Domains:              domains,
-		Hostnames:            hostnames,
-		SlackWebhook:         viper.GetString("SLACK_WEBHOOK"),
-		MattermostWebhook:    viper.GetString("MATTERMOST_WEBHOOK"),
-		NtfyTopic:            viper.GetString("NTFY_TOPIC"),
-		DNSInterval:          dnsInterval,
-		TLSInterval:          tlsInterval,
-		TLSExpiryWarning:     viper.GetInt("TLS_EXPIRY_WARNING"),
-		SentryDSN:            viper.GetString("SENTRY_DSN"),
-		MaintenanceMode:      viper.GetBool("MAINTENANCE_MODE"),
-		MetricsUsername:      viper.GetString("METRICS_USERNAME"),
-		MetricsPassword:      viper.GetString("METRICS_PASSWORD"),
-		SendTestNotification: viper.GetBool("SEND_TEST_NOTIFICATION"),
-		params:               params,
-		log:                  log,
+		Port:                    viper.GetInt("PORT"),
+		Debug:                   viper.GetBool("DEBUG"),
+		DataDir:                 viper.GetString("DATA_DIR"),
+		Domains:                 domains,
+		Hostnames:               hostnames,
+		SkipRecordNotifications: skipRecordNotifications,
+		SlackWebhook:            viper.GetString("SLACK_WEBHOOK"),
+		MattermostWebhook:       viper.GetString("MATTERMOST_WEBHOOK"),
+		NtfyTopic:               viper.GetString("NTFY_TOPIC"),
+		DNSInterval:             dnsInterval,
+		TLSInterval:             tlsInterval,
+		TLSExpiryWarning:        viper.GetInt("TLS_EXPIRY_WARNING"),
+		SentryDSN:               viper.GetString("SENTRY_DSN"),
+		MaintenanceMode:         viper.GetBool("MAINTENANCE_MODE"),
+		MetricsUsername:         viper.GetString("METRICS_USERNAME"),
+		MetricsPassword:         viper.GetString("METRICS_PASSWORD"),
+		SendTestNotification:    viper.GetBool("SEND_TEST_NOTIFICATION"),
+		params:                  params,
+		log:                     log,
 	}
 
 	return cfg, nil
@@ -204,6 +219,36 @@ func parseAndValidateTargets() ([]string, []string, error) {
 	return domains, hostnames, nil
 }
 
+// parseSkipRecordNotifications reads DNSWATCHER_SKIP_RECORD_NOTIFICATIONS,
+// a comma-separated list of names from the targets. Each name is written
+// as ClassifyTargets writes a target, in lower case without a trailing
+// dot, and a name listed more than once is kept once. A name that is
+// not one of domains or hostnames is an error naming it.
+func parseSkipRecordNotifications(
+	domains, hostnames []string,
+) ([]string, error) {
+	value := viper.GetString("SKIP_RECORD_NOTIFICATIONS")
+
+	var names []string
+
+	for _, listed := range parseCSV(value) {
+		name := strings.ToLower(strings.TrimSuffix(listed, "."))
+
+		if !slices.Contains(domains, name) && !slices.Contains(hostnames, name) {
+			return nil, fmt.Errorf(
+				"invalid DNSWATCHER_SKIP_RECORD_NOTIFICATIONS %q: %w",
+				listed, ErrNotInTargets,
+			)
+		}
+
+		if !slices.Contains(names, name) {
+			names = append(names, name)
+		}
+	}
+
+	return names, nil
+}
+
 func parseCSV(input string) []string {
 	if input == "" {
 		return nil

internal/config/config_test.go

@@ -57,6 +57,7 @@ func TestNew_DefaultValues(t *testing.T) {
 	assert.Empty(t, cfg.MetricsUsername)
 	assert.Empty(t, cfg.MetricsPassword)
 	assert.False(t, cfg.SendTestNotification)
+	assert.Empty(t, cfg.SkipRecordNotifications)
 }
 
 func TestNew_EnvironmentOverrides(t *testing.T) {
@@ -235,6 +236,33 @@ func TestNew_TargetsWithTrailingComma(t *testing.T) {
 		"trailing comma should be ignored")
 }
 
+func TestNew_SkipRecordNotifications(t *testing.T) {
+	viper.Reset()
+	t.Setenv("DNSWATCHER_TARGETS", "example.net,www.example.net,example.org")
+	t.Setenv("DNSWATCHER_SKIP_RECORD_NOTIFICATIONS",
+		" WWW.Example.net. , example.net,www.example.net")
+
+	cfg, err := config.New(nil, newTestParams(t))
+	require.NoError(t, err)
+	assert.Equal(t,
+		[]string{"www.example.net", "example.net"},
+		cfg.SkipRecordNotifications,
+		"names are written as targets are, each once",
+	)
+}
+
+func TestNew_SkipRecordNotificationsNotInTargetsStopsStartup(t *testing.T) {
+	viper.Reset()
+	t.Setenv("DNSWATCHER_TARGETS", "example.net")
+	t.Setenv("DNSWATCHER_SKIP_RECORD_NOTIFICATIONS",
+		"example.net,www.example.net")
+
+	_, err := config.New(nil, newTestParams(t))
+	require.ErrorIs(t, err, config.ErrNotInTargets)
+	require.ErrorContains(t, err, "DNSWATCHER_SKIP_RECORD_NOTIFICATIONS")
+	require.ErrorContains(t, err, `"www.example.net"`)
+}
+
 func TestNew_CustomDNSIntervalDuration(t *testing.T) {
 	viper.Reset()
 	t.Setenv("DNSWATCHER_TARGETS", "example.com")

internal/handlers/dashboard.go

@@ -45,11 +45,14 @@ func newDashboardTemplate() *template.Template {
 
 // dashboardData is the data passed to the dashboard template. Hostnames
 // and DomainRecords split the records in Snapshot.Hostnames, which also
-// holds the apex domains' own (see splitHostnames).
+// holds the apex domains' own (see splitHostnames). Ports holds
+// Snapshot.Ports with each port's names split into domains and
+// hostnames, as /api/v1/status gives them (see buildPorts).
 type dashboardData struct {
 	Snapshot      state.Snapshot
 	Hostnames     map[string]*state.HostnameState
 	DomainRecords map[string]*state.HostnameState
+	Ports         map[string]*statusPortInfo
 	Alerts        []notify.AlertEntry
 	StateAge      string
 	GeneratedAt   string
@@ -71,6 +74,7 @@ func (h *Handlers) HandleDashboard() http.HandlerFunc {
 			Snapshot:      snap,
 			Hostnames:     hostnames,
 			DomainRecords: domainRecords,
+			Ports:         buildPorts(snap),
 			Alerts:        alerts,
 			StateAge:      relTime(snap.LastUpdated),
 			GeneratedAt:   time.Now().UTC().Format("2006-01-02 15:04:05"),

internal/handlers/dashboard_test.go

@@ -191,17 +191,83 @@ func TestDashboardShowsDomainRecordsUnderDomains(t *testing.T) {
 
 	words := strings.Join(strings.Fields(page), " ")
 
-	footer := "monitoring 1 domains + 1 hostnames"
+	footer := "monitoring 2 domains + 1 hostnames"
 	if !strings.Contains(words, footer) {
 		t.Errorf("dashboard does not say %q", footer)
 	}
 
-	// With the tags taken out, the summary bar starts "Domains 1
+	// With the tags taken out, the summary bar starts "Domains 2
 	// Hostnames 1".
 	text := regexp.MustCompile(`<[^>]*>`).ReplaceAllString(page, " ")
-	summary := "Domains 1 Hostnames 1"
+	summary := "Domains 2 Hostnames 1"
 
 	if !strings.Contains(strings.Join(strings.Fields(text), " "), summary) {
 		t.Errorf("summary bar does not say %q", summary)
 	}
 }
+
+// TestDashboardMarksDomainThatDoesNotExist checks that the Domains
+// section says a domain that does not exist does not exist, and does
+// not say so of a domain that exists.
+func TestDashboardMarksDomainThatDoesNotExist(t *testing.T) {
+	t.Parallel()
+
+	page := get(t, newHandlersWithFailures(t).HandleDashboard())
+	domains := dashboardSection(t, page, "Domains")
+
+	if !strings.Contains(dashboardRow(t, domains, missingDomain), "does not exist") {
+		t.Errorf("row of %s does not say it does not exist", missingDomain)
+	}
+
+	if strings.Contains(dashboardRow(t, domains, testDomain), "does not exist") {
+		t.Errorf("row of %s says it does not exist", testDomain)
+	}
+}
+
+// rowCells returns the text of each cell of a dashboard table row
+// whose cells start with tag, "<th" or "<td".
+func rowCells(row string, tag string) []string {
+	tags := regexp.MustCompile(`<[^>]*>`)
+	parts := strings.Split(row, tag)[1:]
+	cells := make([]string, 0, len(parts))
+
+	for _, cell := range parts {
+		text := tags.ReplaceAllString(tag+cell, " ")
+		cells = append(cells, strings.Join(strings.Fields(text), " "))
+	}
+
+	return cells
+}
+
+// TestDashboardPortsTellDomainsFromHostnames checks that the Ports
+// table lists an apex domain under Domains and a hostname under
+// Hostnames when both resolve to the port's address.
+func TestDashboardPortsTellDomainsFromHostnames(t *testing.T) {
+	t.Parallel()
+
+	page := get(t, newHandlersWithFailures(t).HandleDashboard())
+	ports := dashboardSection(t, page, "Ports")
+
+	headings := rowCells(dashboardRow(t, ports, "Address</th>"), "<th")
+	cells := rowCells(dashboardRow(t, ports, sharedPort), "<td")
+
+	if len(cells) != len(headings) {
+		t.Fatalf("row of %s has cells %q under headings %q",
+			sharedPort, cells, headings)
+	}
+
+	under := make(map[string]string)
+	for i, heading := range headings {
+		under[heading] = cells[i]
+	}
+
+	if under["Domains"] != testDomain {
+		t.Errorf("row of %s lists %q under Domains, want %q",
+			sharedPort, under["Domains"], testDomain)
+	}
+
+	if under["Hostnames"] != testHostname {
+		t.Errorf("row of %s lists %q under Hostnames, want %q",
+			sharedPort, under["Hostnames"], testHostname)
+	}
+}

internal/handlers/status.go

@@ -10,10 +10,12 @@ import (
 
 // statusDomainInfo holds status information for a monitored domain.
 // RecordsByNameserver holds the domain's own records, in the form a
-// hostname's Nameservers holds the hostname's.
+// hostname's Nameservers holds the hostname's. NXDomain is true when
+// the domain's parent zone's servers answered that it does not exist.
 type statusDomainInfo struct {
 	Nameservers         []string                         `json:"nameservers"`
 	RecordsByNameserver map[string]*statusHostnameNSInfo `json:"recordsByNameserver"`
+	NXDomain            bool                             `json:"nxdomain"`
 	LastChecked         time.Time                        `json:"lastChecked"`
 }
 
@@ -32,8 +34,11 @@ type statusHostnameInfo struct {
 }
 
 // statusPortInfo holds status information for a monitored port.
+// Domains and Hostnames list the apex domains and the hostnames that
+// resolve to its address.
 type statusPortInfo struct {
 	Open        bool      `json:"open"`
+	Domains     []string  `json:"domains"`
 	Hostnames   []string  `json:"hostnames"`
 	LastChecked time.Time `json:"lastChecked"`
 }
@@ -99,7 +104,6 @@ func buildStatusResponse(
 		LastUpdated:  snap.LastUpdated,
 		Domains:      make(map[string]*statusDomainInfo),
 		Hostnames:    make(map[string]*statusHostnameInfo),
-		Ports:        make(map[string]*statusPortInfo),
 		Certificates: make(map[string]*statusCertificateInfo),
 	}
 
@@ -107,7 +111,7 @@ func buildStatusResponse(
 
 	buildDomains(snap, domainRecords, resp)
 	buildHostnames(hostnames, resp)
-	buildPorts(snap, resp)
+	resp.Ports = buildPorts(snap)
 	buildCertificates(snap, resp)
 	buildCounts(resp)
 
@@ -153,6 +157,7 @@ func buildDomains(
 		resp.Domains[name] = &statusDomainInfo{
 			Nameservers:         ns,
 			RecordsByNameserver: records,
+			NXDomain:            ds.NXDomain,
 			LastChecked:         ds.LastChecked,
 		}
 	}
@@ -195,21 +200,36 @@ func nameserverInfo(
 	return info
 }
 
-func buildPorts(
-	snap state.Snapshot,
-	resp *statusResponse,
-) {
+// buildPorts returns the port entries saved in snap. A port entry
+// saves apex domains with its hostnames; they are told apart as in
+// splitHostnames, by a domain entry in snap.Domains.
+func buildPorts(snap state.Snapshot) map[string]*statusPortInfo {
+	ports := make(map[string]*statusPortInfo, len(snap.Ports))
+
 	for key, ps := range snap.Ports {
-		hostnames := make([]string, len(ps.Hostnames))
-		copy(hostnames, ps.Hostnames)
+		domains := []string{}
+		hostnames := []string{}
+
+		for _, name := range ps.Hostnames {
+			if _, isDomain := snap.Domains[name]; isDomain {
+				domains = append(domains, name)
+			} else {
+				hostnames = append(hostnames, name)
+			}
+		}
+
+		sort.Strings(domains)
 		sort.Strings(hostnames)
 
-		resp.Ports[key] = &statusPortInfo{
+		ports[key] = &statusPortInfo{
 			Open:        ps.Open,
+			Domains:     domains,
 			Hostnames:   hostnames,
 			LastChecked: ps.LastChecked,
 		}
 	}
+
+	return ports
 }
 
 func buildCertificates(

internal/handlers/status_test.go

@@ -21,8 +21,12 @@ import (
 // The state the handler tests serve: www.example.com has one nameserver
 // that answered and one whose query failed, and its certificate check
 // failed. example.net is an apex domain, whose own records are saved
-// with the hostnames' records, as the watcher saves them.
+// with the hostnames' records, as the watcher saves them. Both names
+// resolve to domainAddress, whose port 443 entry lists them.
+// missingDomain is an apex domain whose parent zone's servers answered
+// that it does not exist, saved with no nameservers and no records.
 const (
+	missingDomain    = "does-not-exist.example"
 	testHostname     = "www.example.com"
 	answeringNS      = "ns1.example.com."
 	failedNS         = "ns2.example.com."
@@ -32,6 +36,7 @@ const (
 	testDomain       = "example.net"
 	domainNS         = "a.iana-servers.net."
 	domainAddress    = "192.0.2.2"
+	sharedPort       = domainAddress + ":443"
 )
 
 // newHandlersWithFailures builds real Handlers whose state holds the
@@ -65,12 +70,31 @@ func newHandlersWithFailures(t *testing.T) *handlers.Handlers {
 		t.Fatalf("state.New: %v", err)
 	}
 
+	setTestState(st)
+
+	hnd, err := handlers.New(nil, handlers.Params{
+		Logger:  log,
+		Globals: glob,
+		State:   st,
+		Notify:  notifier,
+	})
+	if err != nil {
+		t.Fatalf("handlers.New: %v", err)
+	}
+
+	return hnd
+}
+
+// setTestState sets the entries described above in st.
+func setTestState(st *state.State) {
 	now := time.Now()
 
 	st.SetHostnameState(testHostname, &state.HostnameState{
 		RecordsByNameserver: map[string]*state.NameserverRecordState{
 			answeringNS: {
-				Records:     map[string][]string{"A": {"192.0.2.1"}},
+				Records: map[string][]string{
+					"A": {"192.0.2.1", domainAddress},
+				},
 				Status:      "ok",
 				LastChecked: now,
 			},
@@ -106,17 +130,17 @@ func newHandlersWithFailures(t *testing.T) *handlers.Handlers {
 		LastChecked: now,
 	})
 
-	hnd, err := handlers.New(nil, handlers.Params{
-		Logger:  log,
-		Globals: glob,
-		State:   st,
-		Notify:  notifier,
+	st.SetPortState(sharedPort, &state.PortState{
+		Open:        true,
+		Hostnames:   []string{testDomain, testHostname},
+		LastChecked: now,
 	})
-	if err != nil {
-		t.Fatalf("handlers.New: %v", err)
-	}
 
-	return hnd
+	st.SetDomainState(missingDomain, &state.DomainState{
+		Nameservers: []string{},
+		NXDomain:    true,
+		LastChecked: now,
+	})
 }
 
 // get serves one GET request to handler and returns the response body.
@@ -217,3 +241,69 @@ func TestStatusGivesDomainRecordsUnderTheDomain(t *testing.T) {
 			testDomain, domainNS, records, domainAddress)
 	}
 }
+
+// TestStatusMarksDomainThatDoesNotExist checks that /api/v1/status sets
+// nxdomain for a domain that does not exist, with no nameservers or
+// records, and not for a domain that exists.
+func TestStatusMarksDomainThatDoesNotExist(t *testing.T) {
+	t.Parallel()
+
+	body := get(t, newHandlersWithFailures(t).HandleStatus())
+
+	var resp struct {
+		Domains map[string]struct {
+			Nameservers         []string       `json:"nameservers"`
+			RecordsByNameserver map[string]any `json:"recordsByNameserver"`
+			NXDomain            bool           `json:"nxdomain"`
+		} `json:"domains"`
+	}
+
+	err := json.Unmarshal([]byte(body), &resp)
+	if err != nil {
+		t.Fatalf("decoding response: %v", err)
+	}
+
+	missing := resp.Domains[missingDomain]
+	if !missing.NXDomain || len(missing.Nameservers) != 0 ||
+		len(missing.RecordsByNameserver) != 0 {
+		t.Errorf("domain %s = %+v, want nxdomain and nothing else",
+			missingDomain, missing)
+	}
+
+	if resp.Domains[testDomain].NXDomain {
+		t.Errorf("domain %s has nxdomain set", testDomain)
+	}
+}
+
+// TestStatusPortsTellDomainsFromHostnames checks that a port entry in
+// /api/v1/status lists an apex domain in domains and a hostname in
+// hostnames when both resolve to its address.
+func TestStatusPortsTellDomainsFromHostnames(t *testing.T) {
+	t.Parallel()
+
+	body := get(t, newHandlersWithFailures(t).HandleStatus())
+
+	var resp struct {
+		Ports map[string]struct {
+			Domains   []string `json:"domains"`
+			Hostnames []string `json:"hostnames"`
+		} `json:"ports"`
+	}
+
+	err := json.Unmarshal([]byte(body), &resp)
+	if err != nil {
+		t.Fatalf("decoding response: %v", err)
+	}
+
+	port := resp.Ports[sharedPort]
+
+	if !slices.Equal(port.Domains, []string{testDomain}) {
+		t.Errorf("port %s domains = %v, want [%s]",
+			sharedPort, port.Domains, testDomain)
+	}
+
+	if !slices.Equal(port.Hostnames, []string{testHostname}) {
+		t.Errorf("port %s hostnames = %v, want [%s]",
+			sharedPort, port.Hostnames, testHostname)
+	}
+}

internal/handlers/templates/dashboard.html

@@ -84,7 +84,11 @@
                   {{ $name }}
                 </td>
                 <td class="py-2 px-3 text-slate-400 break-all">
+                  {{ if $ds.NXDomain }}
+                  <span class="text-red-400">does not exist</span>
+                  {{ else }}
                   {{ joinStrings $ds.Nameservers ", " }}
+                  {{ end }}
                 </td>
                 <td class="py-2 px-3 text-slate-500 whitespace-nowrap">
                   {{ relTime $ds.LastChecked }}
@@ -157,19 +161,20 @@
         >
           Ports
         </h2>
-        {{ if .Snapshot.Ports }}
+        {{ if .Ports }}
         <div class="overflow-x-auto">
           <table class="w-full text-left text-xs">
             <thead>
               <tr class="text-slate-500 uppercase tracking-wider">
                 <th class="py-2 px-3">Address</th>
                 <th class="py-2 px-3">State</th>
+                <th class="py-2 px-3">Domains</th>
                 <th class="py-2 px-3">Hostnames</th>
                 <th class="py-2 px-3">Checked</th>
               </tr>
             </thead>
             <tbody class="divide-y divide-slate-800">
-              {{ range $key, $ps := .Snapshot.Ports }}
+              {{ range $key, $ps := .Ports }}
               <tr class="hover:bg-surface-800/50">
                 <td class="py-2 px-3 text-slate-200 font-medium">
                   {{ $key }}
@@ -187,6 +192,9 @@
                   >
                   {{ end }}
                 </td>
+                <td class="py-2 px-3 text-slate-400 break-all">
+                  {{ joinStrings $ps.Domains ", " }}
+                </td>
                 <td class="py-2 px-3 text-slate-400 break-all">
                   {{ joinStrings $ps.Hostnames ", " }}
                 </td>

internal/resolver/errors.go

@@ -10,6 +10,10 @@ var (
 		"no authoritative nameservers found",
 	)
 
+	// ErrNXDomain is returned when the servers of the zone a domain
+	// is in answer NXDOMAIN: the domain does not exist.
+	ErrNXDomain = errors.New("domain does not exist")
+
 	// ErrNoNameserverAnswered is returned when every nameserver
 	// asked about a name timed out, failed or returned a referral,
 	// so whether the name has addresses is unknown.

internal/resolver/export_test.go

@@ -17,6 +17,43 @@ func NewWithFailingTCP(log *slog.Logger) *Resolver {
 	return r
 }
 
+// NewWithQueryTimeout returns a Resolver whose queries over UDP give up
+// after timeout, so a test that asks an address where nothing answers
+// does not wait out the usual timeout.
+func NewWithQueryTimeout(log *slog.Logger, timeout time.Duration) *Resolver {
+	r := NewFromLogger(log)
+	r.client = &udpClient{timeout: timeout}
+
+	return r
+}
+
+// FollowDelegation exports followDelegation for testing.
+func (r *Resolver) FollowDelegation(
+	ctx context.Context,
+	domain string,
+	servers []string,
+) ([]string, error) {
+	return r.followDelegation(ctx, domain, servers)
+}
+
+// FindAuthoritativeNameserversFrom exports findAuthoritativeNameservers
+// for testing.
+func (r *Resolver) FindAuthoritativeNameserversFrom(
+	ctx context.Context,
+	domain string,
+	servers []string,
+) ([]string, error) {
+	return r.findAuthoritativeNameservers(ctx, domain, servers)
+}
+
+// ResolveNSIterative exports resolveNSIterative for testing.
+func (r *Resolver) ResolveNSIterative(
+	ctx context.Context,
+	domain string,
+) ([]string, error) {
+	return r.resolveNSIterative(ctx, domain)
+}
+
 // ExtractRecordValue exports extractRecordValue for testing.
 func ExtractRecordValue(rr dns.RR) string {
 	return extractRecordValue(rr)

internal/resolver/iterative.go

@@ -8,6 +8,7 @@ import (
 	"net"
 	"slices"
 	"sort"
+	"strconv"
 	"strings"
 	"time"
 
@@ -203,6 +204,12 @@ func glueIPs(nsNames []string, glue map[string][]net.IP) []string {
 	return ips
 }
 
+// followDelegation follows referrals from servers, the root servers, to
+// domain and returns the NS set of domain's delegation. When the servers
+// of the zone domain is in answer that domain does not exist, the error
+// is ErrNXDomain. When they answer that it has no delegation of its own,
+// because it is not the zone's apex, the set is empty and there is no
+// error. Any other error means that no such answer came.
 func (r *Resolver) followDelegation(
 	ctx context.Context,
 	domain string,
@@ -233,10 +240,15 @@ func (r *Resolver) followDelegation(
 		// An authoritative reply comes from the servers of the zone
 		// domain is in; it is not a referral, even when its authority
 		// section lists that zone's NS records. Without NS records in
-		// the answer, domain is not the zone's apex and has no
-		// nameservers of its own.
+		// the answer, domain has no nameservers of its own: it does
+		// not exist, when the reply is NXDOMAIN, or else it is not the
+		// zone's apex.
+		if resp.Authoritative && resp.Rcode == dns.RcodeNameError {
+			return nil, ErrNXDomain
+		}
+
 		if resp.Authoritative {
-			return nil, ErrNoNameservers
+			return []string{}, nil
 		}
 
 		authNS := extractNSSet(resp.Ns)
@@ -485,7 +497,8 @@ func (r *Resolver) resolveNSIPs(
 
 // resolveNSIterative queries for NS records using iterative
 // resolution as a fallback when followDelegation finds no
-// authoritative answer in the delegation chain.
+// authoritative answer in the delegation chain. Its result means what
+// followDelegation's does.
 func (r *Resolver) resolveNSIterative(
 	ctx context.Context,
 	domain string,
@@ -515,6 +528,16 @@ func (r *Resolver) resolveNSIterative(
 			return nsNames, nil
 		}
 
+		// As in followDelegation: domain has no nameservers of its
+		// own.
+		if resp.Authoritative && resp.Rcode == dns.RcodeNameError {
+			return nil, ErrNXDomain
+		}
+
+		if resp.Authoritative {
+			return []string{}, nil
+		}
+
 		// Follow delegation.
 		authNS := extractNSSet(resp.Ns)
 		if len(authNS) == 0 {
@@ -600,12 +623,23 @@ func (r *Resolver) resolveARecord(
 // FindAuthoritativeNameservers traces the delegation chain from
 // root servers to discover all authoritative nameservers for the
 // given domain, as the delegation from its parent zone's servers lists
-// them. For a name that is not a zone apex it tries each
-// parent name in turn, so it returns the nameservers of the zone the
-// name is in.
+// them. When the servers asked answer that the name has no delegation
+// of its own, or does not exist, it tries each parent name in turn, so
+// it returns the nameservers of the zone the name is in. When they do
+// not answer, it returns the error and tries no parent name.
 func (r *Resolver) FindAuthoritativeNameservers(
 	ctx context.Context,
 	domain string,
+) ([]string, error) {
+	return r.findAuthoritativeNameservers(ctx, domain, rootServerList())
+}
+
+// findAuthoritativeNameservers is FindAuthoritativeNameservers with each
+// walk starting at servers, the root servers.
+func (r *Resolver) findAuthoritativeNameservers(
+	ctx context.Context,
+	domain string,
+	servers []string,
 ) ([]string, error) {
 	if checkCtx(ctx) != nil {
 		return nil, ErrContextCanceled
@@ -621,19 +655,16 @@ func (r *Resolver) FindAuthoritativeNameservers(
 
 		candidate := strings.Join(labels[i:], ".") + "."
 
-		nsNames, err := r.followDelegation(
-			ctx, candidate, rootServerList(),
-		)
-		if err == nil && len(nsNames) > 0 {
+		nsNames, err := r.followDelegation(ctx, candidate, servers)
+		if err != nil && !errors.Is(err, ErrNXDomain) {
+			return nil, err
+		}
+
+		if len(nsNames) > 0 {
 			sort.Strings(nsNames)
 
 			return nsNames, nil
 		}
-
-		// The root servers would refuse every parent name too.
-		if errors.Is(err, ErrIntercepted) {
-			return nil, err
-		}
 	}
 
 	return nil, ErrNoNameservers
@@ -724,14 +755,15 @@ func (r *Resolver) queryTypes(
 }
 
 type queryState struct {
-	gotNXDomain bool
-	errorReply  string // code of an error reply, such as SERVFAIL
-	gotRefused  bool
-	gotTimeout  bool
-	gotReferral bool
-	netErr      error
-	hasRecords  bool
-	answered    bool
+	gotNXDomain   bool
+	gotErrorReply bool
+	errorReply    string // its code, such as SERVFAIL, or number if unnamed
+	gotRefused    bool
+	gotTimeout    bool
+	gotReferral   bool
+	netErr        error
+	hasRecords    bool
+	answered      bool
 }
 
 // queryEachType asks the nameserver at nsIP about hostname once for each
@@ -833,7 +865,14 @@ func readReply(
 	}
 
 	if isErrorReply(msg) {
-		state.errorReply = dns.RcodeToString[msg.Rcode]
+		state.gotErrorReply = true
+
+		code, named := dns.RcodeToString[msg.Rcode]
+		if !named {
+			code = strconv.Itoa(msg.Rcode)
+		}
+
+		state.errorReply = code
 
 		return fmt.Errorf(
 			"server returned %s: %w", state.errorReply, ErrUnusableReply,
@@ -843,9 +882,7 @@ func readReply(
 	// A reply with no answer that lists other nameservers, from a server
 	// that does not hold the name's zone, is a referral and says nothing
 	// about the name's records. A server named in the delegation that
-	// does not hold the zone may send one, as do a parent zone's servers
-	// when FindAuthoritativeNameservers found no delegation for the
-	// name's zone and moved on to a parent name.
+	// does not hold the zone may send one.
 	if !msg.Authoritative && len(msg.Answer) == 0 &&
 		len(extractNSSet(msg.Ns)) > 0 {
 		state.gotReferral = true
@@ -904,7 +941,9 @@ func isTimeout(err error) bool {
 
 // classifyResponse sets the nameserver's status. One that answered no
 // record type has failed, and Error says why; one that answered some has
-// the status of those answers.
+// the status of those answers. It has no data only when every type
+// answered with no records: a type in FailedTypes may have records, so a
+// nameserver with one stays ok.
 func classifyResponse(resp *NameserverResponse, state queryState) {
 	switch {
 	case state.gotNXDomain && !state.hasRecords:
@@ -912,7 +951,7 @@ func classifyResponse(resp *NameserverResponse, state queryState) {
 	case state.gotTimeout && !state.answered:
 		resp.Status = StatusTimeout
 		resp.Error = "all queries timed out"
-	case state.errorReply != "" && !state.answered:
+	case state.gotErrorReply && !state.answered:
 		resp.Status = StatusError
 		resp.Error = "server returned " + state.errorReply
 	case state.gotRefused && !state.answered:
@@ -924,7 +963,8 @@ func classifyResponse(resp *NameserverResponse, state queryState) {
 	case state.gotReferral && !state.answered:
 		resp.Status = StatusError
 		resp.Error = "server returned a referral"
-	case !state.hasRecords && !state.gotNXDomain:
+	// An NXDOMAIN reply with no records was taken by the first case.
+	case !state.hasRecords && len(resp.FailedTypes) == 0:
 		resp.Status = StatusNoData
 	}
 }
@@ -1013,12 +1053,22 @@ func (r *Resolver) queryEachNS(
 	return results, nil
 }
 
-// LookupNS returns the NS record set for a domain.
+// LookupNS returns the NS record set of a domain, as the delegation from
+// its parent zone's servers lists it, and never a parent name's. When
+// they answer that the domain does not exist, the error is ErrNXDomain.
+// When they answer that it has no delegation of its own, the set is
+// empty and there is no error.
 func (r *Resolver) LookupNS(
 	ctx context.Context,
 	domain string,
 ) ([]string, error) {
-	return r.FindAuthoritativeNameservers(ctx, domain)
+	if checkCtx(ctx) != nil {
+		return nil, ErrContextCanceled
+	}
+
+	return r.followDelegation(
+		ctx, dns.Fqdn(strings.ToLower(domain)), rootServerList(),
+	)
 }
 
 // LookupAllRecords performs iterative resolution to find all DNS

internal/resolver/iterative_internal_test.go

@@ -1,66 +1,87 @@
 package resolver
 
 import (
+	"strconv"
 	"syscall"
 	"testing"
 
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 // TestClassifyResponse sets a nameserver's status from the results of
-// its queries, built here. One that answered some record types, even
-// with no records, has not failed when its query for another type got
-// no usable reply, whatever the reason; one whose every query got none
-// has.
+// its queries and the record types whose query failed, built here. One
+// that answered some record types, even with no records, has not failed
+// when its query for another type got no usable reply, whatever the
+// reason, and is ok, not nodata: that type may have records. One whose
+// every query got none has failed. Only one whose every type answered
+// with no records is nodata.
 func TestClassifyResponse(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
-		name       string
-		results    queryState
-		wantStatus string
-		wantError  string
+		name        string
+		results     queryState
+		failedTypes []string
+		wantStatus  string
+		wantError   string
 	}{
 		{
-			"some types answered with no records, another timed out",
-			queryState{answered: true, gotTimeout: true},
+			"every type answered with no records",
+			queryState{answered: true},
+			nil,
 			StatusNoData, "",
 		},
+		{
+			"some types answered with no records, another timed out",
+			queryState{answered: true, gotTimeout: true},
+			[]string{"A"},
+			StatusOK, "",
+		},
 		{
 			"some types answered with no records, another got SERVFAIL",
-			queryState{answered: true, errorReply: "SERVFAIL"},
-			StatusNoData, "",
+			queryState{
+				answered: true, gotErrorReply: true, errorReply: "SERVFAIL",
+			},
+			[]string{"A"},
+			StatusOK, "",
 		},
 		{
 			"some types answered with no records, another was refused",
 			queryState{answered: true, gotRefused: true},
-			StatusNoData, "",
+			[]string{"A"},
+			StatusOK, "",
 		},
 		{
 			"some types answered with no records, another got a network error",
 			queryState{answered: true, netErr: syscall.ECONNREFUSED},
-			StatusNoData, "",
+			[]string{"A"},
+			StatusOK, "",
 		},
 		{
 			"some types answered with no records, another's reply was " +
 				"truncated and its retry over TCP failed",
 			queryState{answered: true, netErr: ErrTruncated},
-			StatusNoData, "",
+			[]string{"TXT"},
+			StatusOK, "",
 		},
 		{
 			"some types answered with no records, another got a referral",
 			queryState{answered: true, gotReferral: true},
-			StatusNoData, "",
+			[]string{"A"},
+			StatusOK, "",
 		},
 		{
 			"every query timed out",
 			queryState{gotTimeout: true},
+			[]string{"A", "AAAA", "CNAME"},
 			StatusTimeout, "all queries timed out",
 		},
 		{
 			"every query got NOTIMP",
-			queryState{errorReply: "NOTIMP"},
+			queryState{gotErrorReply: true, errorReply: "NOTIMP"},
+			[]string{"A", "AAAA", "CNAME"},
 			StatusError, "server returned NOTIMP",
 		},
 	}
@@ -69,34 +90,39 @@ func TestClassifyResponse(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			resp := &NameserverResponse{Status: StatusOK}
+			resp := &NameserverResponse{Status: StatusOK, FailedTypes: tt.failedTypes}
 			classifyResponse(resp, tt.results)
 
 			assert.Equal(t, tt.wantStatus, resp.Status)
 			assert.Equal(t, tt.wantError, resp.Error)
+			assert.Equal(t, tt.failedTypes, resp.FailedTypes)
 		})
 	}
 }
 
 // TestReadReply checks which replies to a query about one record type,
 // built here, are an answer: one with the code NOERROR or NXDOMAIN. A
-// reply with any other code is not, and the type's query has failed.
+// reply with any other code is not, and the type's query has failed; a
+// nameserver whose only reply it is has failed, and Error gives the
+// code, or its number when the code has no name.
 func TestReadReply(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
-		rcode    int
-		answered bool
+		rcode      int
+		wantStatus string
+		wantError  string
 	}{
-		{dns.RcodeSuccess, true},
-		{dns.RcodeNameError, true},
-		{dns.RcodeServerFailure, false},
-		{dns.RcodeNotImplemented, false},
-		{dns.RcodeFormatError, false},
+		{dns.RcodeSuccess, StatusNoData, ""},
+		{dns.RcodeNameError, StatusNXDomain, ""},
+		{dns.RcodeServerFailure, StatusError, "server returned SERVFAIL"},
+		{dns.RcodeNotImplemented, StatusError, "server returned NOTIMP"},
+		{dns.RcodeFormatError, StatusError, "server returned FORMERR"},
+		{12, StatusError, "server returned 12"}, // unassigned, no name
 	}
 
 	for _, tt := range tests {
-		t.Run(dns.RcodeToString[tt.rcode], func(t *testing.T) {
+		t.Run(strconv.Itoa(tt.rcode), func(t *testing.T) {
 			t.Parallel()
 
 			msg := new(dns.Msg)
@@ -104,13 +130,20 @@ func TestReadReply(t *testing.T) {
 			msg.Rcode = tt.rcode
 
 			resp := &NameserverResponse{Records: map[string][]string{}}
-			err := readReply(msg, resp, &queryState{})
 
-			if tt.answered {
-				assert.NoError(t, err)
+			var state queryState
+
+			err := readReply(msg, resp, &state)
+			classifyResponse(resp, state)
+
+			if tt.wantStatus == StatusError {
+				require.ErrorIs(t, err, ErrUnusableReply)
 			} else {
-				assert.ErrorIs(t, err, ErrUnusableReply)
+				require.NoError(t, err)
 			}
+
+			assert.Equal(t, tt.wantStatus, resp.Status)
+			assert.Equal(t, tt.wantError, resp.Error)
 		})
 	}
 }

internal/resolver/livedns_test.go

@@ -187,8 +187,8 @@ func liveFindAuthoritative(
 	return out
 }
 
-// liveLookupNS is liveFindAuthoritative through the LookupNS entry
-// point, so that both entry points stay independently exercised.
+// liveLookupNS looks up the NS record set of domain, a domain that has
+// one, retrying until the delegation chain can be walked.
 func liveLookupNS(
 	t *testing.T,
 	r *resolver.Resolver,

internal/resolver/resolver_test.go

@@ -25,6 +25,13 @@ import (
 // Test helpers
 // ----------------------------------------------------------------
 
+// nonexistentDomain is a .com domain that does not exist.
+const nonexistentDomain = "dnswatcher-test-does-not-exist.com"
+
+// noAnswerAddress is 192.0.2.1, a documentation address: nothing
+// answers there.
+const noAnswerAddress = "192.0.2.1"
+
 func newTestResolver(t *testing.T) *resolver.Resolver {
 	t.Helper()
 
@@ -88,6 +95,47 @@ func TestFindAuthoritativeNameservers_Subdomain(
 	assert.Equal(t, fromZone, fromHost)
 }
 
+// TestFindAuthoritativeNameservers_DelegatedSubdomain looks up the
+// nameservers of www.cs.cmu.edu, a name in cs.cmu.edu, a zone that
+// cmu.edu delegates to other servers. The servers of cs.cmu.edu answer
+// that the name has no delegation of its own, so it gets their names,
+// not those of the cmu.edu servers. Every referral on the way gives the
+// nameservers' addresses, so the walk sends few queries.
+func TestFindAuthoritativeNameservers_DelegatedSubdomain(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+	fromHost := liveFindAuthoritative(t, r, "www.cs.cmu.edu")
+	fromZone := liveLookupNS(t, r, "cs.cmu.edu")
+	fromParent := liveLookupNS(t, r, "cmu.edu")
+
+	assert.Equal(t, fromZone, fromHost)
+	assert.NotEqual(t, fromParent, fromHost)
+}
+
+// TestFindAuthoritativeNameservers_NoAnswer starts each walk for
+// www.google.com at 192.0.2.1, a documentation address where nothing
+// answers. A walk that got no answer does not say that the name has no
+// delegation of its own, so the lookup returns that walk's error, about
+// www.google.com, and tries no parent name: trying google.com and com
+// would end in ErrNoNameservers, or in the error of a walk for one of
+// them.
+func TestFindAuthoritativeNameservers_NoAnswer(t *testing.T) {
+	t.Parallel()
+
+	r := resolver.NewWithQueryTimeout(slog.Default(), 100*time.Millisecond)
+
+	nameservers, err := r.FindAuthoritativeNameserversFrom(
+		t.Context(), "www.google.com", []string{noAnswerAddress},
+	)
+	require.Error(t, err)
+	require.NotErrorIs(t, err, resolver.ErrNoNameservers)
+	assert.Contains(t, err.Error(), "query www.google.com. @"+noAnswerAddress)
+	assert.Empty(t, nameservers)
+}
+
 func TestFindAuthoritativeNameservers_ReturnsSorted(
 	t *testing.T,
 ) {
@@ -442,48 +490,45 @@ func TestQueryNameserver_Refused(t *testing.T) {
 	assert.Equal(t, "server returned REFUSED", resp.Error)
 }
 
-// TestQueryNameserverIP_RecursiveResolverRefused asks Quad9, a public
-// recursive resolver, about google.com at both of its addresses. Quad9
-// refuses a query that does not ask for recursion and answers one that
-// does. The resolver never asks for recursion, so it must be reported
-// as refusing, never as answering.
-func TestQueryNameserverIP_RecursiveResolverRefused(t *testing.T) {
+// TestQueryServers_RecursiveResolverRefused passes a public recursive
+// resolver to QueryServers as the server of google.com. These resolvers
+// refuse a query that does not ask for recursion and answer one that
+// does. The resolver never asks for recursion, so the query must be
+// reported as refused, never answered. Each resolver is run by a
+// different operator, and they are asked in turn until one replies, so
+// one operator not answering does not fail the test.
+func TestQueryServers_RecursiveResolverRefused(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-
-	for _, ip := range []string{"9.9.9.9", "149.112.112.112"} {
-		var resp *resolver.NameserverResponse
-
-		livednstest.Retry(
-			t,
-			"QueryNameserverIP("+ip+", google.com)",
-			func(ctx context.Context) error {
-				var err error
-
-				resp, err = r.QueryNameserverIP(
-					ctx, ip, ip, "google.com",
-				)
-				if err != nil {
-					return err
-				}
-
-				// A timeout or a network error is no reply at all.
-				if resp.Status == resolver.StatusTimeout ||
-					strings.HasPrefix(resp.Error, "network error") {
-					return fmt.Errorf(
-						"%w: %s: %s",
-						livednstest.ErrNoAnswer, ip, resp.Error,
-					)
-				}
-
-				return nil
-			},
-		)
-
-		assert.Equal(t, resolver.StatusError, resp.Status, ip)
-		assert.Equal(t, "server returned REFUSED", resp.Error, ip)
+	resolvers := []string{
+		"64.6.64.6", "185.222.222.222", "4.2.2.1", "9.9.9.9",
 	}
+
+	var err error
+
+	livednstest.Retry(
+		t,
+		"QueryServers(public recursive resolvers, google.com)",
+		func(ctx context.Context) error {
+			for _, ip := range resolvers {
+				_, err = r.QueryServers(
+					ctx, []string{ip}, "google.com.", "google.com.",
+					dns.TypeA,
+				)
+
+				// A refusal or an answer is a reply; anything else may
+				// be no reply at all, so the next resolver is asked.
+				if err == nil || errors.Is(err, resolver.ErrRefused) {
+					return nil
+				}
+			}
+
+			return fmt.Errorf("%w: %w", livednstest.ErrNoAnswer, err)
+		},
+	)
+
+	require.ErrorIs(t, err, resolver.ErrRefused)
 }
 
 // googleNameserverIPv4s returns the IPv4 addresses of google.com's
@@ -831,8 +876,7 @@ func TestLookupNS_MatchesFindAuthoritative(t *testing.T) {
 // nameservers of g.ntpns.org. The org servers delegate its parent zone,
 // ntpns.org, without the addresses of its nameservers, so the walk has
 // to look them up to ask them. If it did not, the walk for g.ntpns.org
-// would fail and LookupNS would return the nameservers of ntpns.org,
-// which a.ntpns.org is not one of.
+// would fail.
 func TestLookupNS_ParentZoneDelegatedWithoutAddresses(t *testing.T) {
 	t.Parallel()
 
@@ -842,6 +886,131 @@ func TestLookupNS_ParentZoneDelegatedWithoutAddresses(t *testing.T) {
 	assert.Contains(t, nameservers, "a.ntpns.org.")
 }
 
+// TestLookupNS_DomainThatDoesNotExist looks up the nameservers of a .com
+// domain that does not exist. The .com servers answer NXDOMAIN, so the
+// error is ErrNXDomain, and the domain does not get their names.
+func TestLookupNS_DomainThatDoesNotExist(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+
+	var (
+		nameservers []string
+		err         error
+	)
+
+	livednstest.Retry(
+		t,
+		"LookupNS("+nonexistentDomain+")",
+		func(ctx context.Context) error {
+			nameservers, err = r.LookupNS(ctx, nonexistentDomain)
+			if errors.Is(err, resolver.ErrNXDomain) {
+				return nil
+			}
+
+			return err
+		},
+	)
+
+	require.ErrorIs(t, err, resolver.ErrNXDomain)
+	assert.Empty(t, nameservers)
+}
+
+// TestLookupNS_NoDelegationOfItsOwn looks up the nameservers of
+// www.google.com, a name in the google.com zone with no delegation of
+// its own, as a domain such as octocat.github.io is. The google.com
+// servers answer with no NS records for it: the set is empty, and it is
+// not ErrNXDomain.
+func TestLookupNS_NoDelegationOfItsOwn(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+
+	var nameservers []string
+
+	livednstest.Retry(
+		t,
+		"LookupNS(www.google.com)",
+		func(ctx context.Context) error {
+			var err error
+
+			nameservers, err = r.LookupNS(ctx, "www.google.com")
+
+			return err
+		},
+	)
+
+	assert.Empty(t, nameservers)
+}
+
+// TestFollowDelegation_NoAnswer starts the walk LookupNS uses, for
+// google.com, at 192.0.2.1, a documentation address where nothing
+// answers. A walk that got no answer is an error, not an empty set,
+// which the watcher would report as an NS Change with every nameserver
+// removed.
+func TestFollowDelegation_NoAnswer(t *testing.T) {
+	t.Parallel()
+
+	r := resolver.NewWithQueryTimeout(slog.Default(), 100*time.Millisecond)
+
+	nameservers, err := r.FollowDelegation(
+		t.Context(), "google.com.", []string{noAnswerAddress},
+	)
+	require.Error(t, err)
+	assert.Empty(t, nameservers)
+}
+
+// TestResolveNSIterative_NoDelegationOfItsOwn walks to the nameservers
+// of www.google.com as the fallback walk does. As in
+// TestLookupNS_NoDelegationOfItsOwn, the set is empty, with no error.
+func TestResolveNSIterative_NoDelegationOfItsOwn(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+
+	var nameservers []string
+
+	livednstest.Retry(
+		t,
+		"ResolveNSIterative(www.google.com)",
+		func(ctx context.Context) error {
+			var err error
+
+			nameservers, err = r.ResolveNSIterative(ctx, "www.google.com")
+
+			return err
+		},
+	)
+
+	assert.Empty(t, nameservers)
+}
+
+// TestResolveNSIterative_DomainThatDoesNotExist walks to the nameservers
+// of a .com domain that does not exist as the fallback walk does. As in
+// TestLookupNS_DomainThatDoesNotExist, the error is ErrNXDomain.
+func TestResolveNSIterative_DomainThatDoesNotExist(t *testing.T) {
+	t.Parallel()
+
+	r := newTestResolver(t)
+
+	var err error
+
+	livednstest.Retry(
+		t,
+		"ResolveNSIterative("+nonexistentDomain+")",
+		func(ctx context.Context) error {
+			_, err = r.ResolveNSIterative(ctx, nonexistentDomain)
+			if errors.Is(err, resolver.ErrNXDomain) {
+				return nil
+			}
+
+			return err
+		},
+	)
+
+	require.ErrorIs(t, err, resolver.ErrNXDomain)
+}
+
 // ----------------------------------------------------------------
 // ResolveIPAddresses tests
 // ----------------------------------------------------------------

internal/state/state.go

@@ -38,10 +38,13 @@ type Params struct {
 // DomainState holds the monitoring state for an apex domain.
 // NameserverAddresses holds the sorted addresses each nameserver's name
 // resolves to, by nameserver name. A state file written before it
-// existed loads with it nil.
+// existed loads with it nil. NXDomain is true when the domain's parent
+// zone's servers answered that it does not exist; it then has no
+// nameservers.
 type DomainState struct {
 	Nameservers         []string            `json:"nameservers"`
 	NameserverAddresses map[string][]string `json:"nameserverAddresses"`
+	NXDomain            bool                `json:"nxdomain,omitempty"`
 	LastChecked         time.Time           `json:"lastChecked"`
 }
 
@@ -298,6 +301,27 @@ func (s *State) GetDomainState(
 	return ds, ok
 }
 
+// DeleteDomainState removes a domain state entry.
+func (s *State) DeleteDomainState(domain string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	delete(s.snapshot.Domains, domain)
+}
+
+// GetAllDomainNames returns the names of all domain state entries.
+func (s *State) GetAllDomainNames() []string {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	names := make([]string, 0, len(s.snapshot.Domains))
+	for name := range s.snapshot.Domains {
+		names = append(names, name)
+	}
+
+	return names
+}
+
 // SetHostnameState updates the state for a hostname.
 func (s *State) SetHostnameState(
 	hostname string,
@@ -321,6 +345,28 @@ func (s *State) GetHostnameState(
 	return hs, ok
 }
 
+// DeleteHostnameState removes a hostname state entry.
+func (s *State) DeleteHostnameState(hostname string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	delete(s.snapshot.Hostnames, hostname)
+}
+
+// GetAllHostnames returns the names of all hostname state entries,
+// which include each apex domain's own records.
+func (s *State) GetAllHostnames() []string {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	names := make([]string, 0, len(s.snapshot.Hostnames))
+	for name := range s.snapshot.Hostnames {
+		names = append(names, name)
+	}
+
+	return names
+}
+
 // SetPortState updates the state for a port.
 func (s *State) SetPortState(key string, ps *PortState) {
 	s.mu.Lock()
@@ -383,6 +429,27 @@ func (s *State) GetCertificateState(
 	return cs, ok
 }
 
+// DeleteCertificateState removes a certificate state entry.
+func (s *State) DeleteCertificateState(key string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	delete(s.snapshot.Certificates, key)
+}
+
+// GetAllCertificateKeys returns all certificate state keys.
+func (s *State) GetAllCertificateKeys() []string {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	keys := make([]string, 0, len(s.snapshot.Certificates))
+	for k := range s.snapshot.Certificates {
+		keys = append(keys, k)
+	}
+
+	return keys
+}
+
 // checkDataDirWritable creates the data directory if needed, then writes
 // and removes the temp file that Save uses. It runs at startup so that an
 // unwritable directory stops the process, instead of the process running

internal/watcher/export_test.go

@@ -107,6 +107,11 @@ func (w *Watcher) MaybeSendTestNotification(ctx context.Context) {
 	w.maybeSendTestNotification(ctx)
 }
 
+// CleanupRemovedTargets exports cleanupRemovedTargets for testing.
+func (w *Watcher) CleanupRemovedTargets() {
+	w.cleanupRemovedTargets()
+}
+
 // CheckAllPorts exports checkAllPorts for testing.
 func (w *Watcher) CheckAllPorts(ctx context.Context) {
 	w.checkAllPorts(ctx)

internal/watcher/interfaces.go

@@ -11,7 +11,9 @@ import (
 
 // DNSResolver performs iterative DNS resolution.
 type DNSResolver interface {
-	// LookupNS discovers authoritative nameservers for a domain.
+	// LookupNS returns a domain's NS record set, as its parent zone's
+	// servers delegate it: empty when they answer that it has none, and
+	// resolver.ErrNXDomain when they answer that it does not exist.
 	LookupNS(
 		ctx context.Context,
 		domain string,

internal/watcher/message_test.go

@@ -165,3 +165,51 @@ func TestStartupNotificationCountsConfiguredNames(t *testing.T) {
 		t.Errorf("sent %v, want one message with %q", notifications, counts)
 	}
 }
+
+// A Port Change notification lists the configured apex domain and the
+// hostname that resolve to the port's address on separate lines. The
+// port checks read the saved hostname state and look nothing up, so the
+// watcher has no resolver.
+func TestPortChangeListsDomainsApartFromHostnames(t *testing.T) {
+	t.Parallel()
+
+	cfg := defaultTestConfig(t)
+	cfg.Domains = []string{domain}
+	cfg.Hostnames = []string{host}
+
+	deps := newTestDeps(t, cfg)
+	w := watcher.NewForTest(
+		cfg, deps.state, nil,
+		deps.portChecker, deps.tlsChecker, deps.notifier,
+	)
+	w.SetFirstRun(false)
+
+	// Both names resolve to ip1, whose port 443 the previous check
+	// found open. It is closed now.
+	for _, name := range []string{domain, host} {
+		deps.state.SetHostnameState(name, saved(
+			map[string]*state.NameserverRecordState{
+				nsA: answered(map[string][]string{"A": {ip1}}),
+			},
+		))
+	}
+
+	key := ip1 + ":443"
+	deps.state.SetPortState(key, &state.PortState{
+		Open: true, Hostnames: []string{domain, host},
+	})
+	deps.portChecker.closed = true
+
+	w.CheckAllPorts(t.Context())
+
+	title := "Port Change: " + key
+	want := `Domains: example.net
+Hostnames: www.example.net
+Address: 192.0.2.1:443
+Port now closed`
+
+	got := deps.notifier.getNotifications()
+	if len(got) != 1 || got[0].Title != title || got[0].Message != want {
+		t.Errorf("sent %v, want one %q with message:\n%s", got, title, want)
+	}
+}

internal/watcher/removed_test.go

@@ -0,0 +1,224 @@
+package watcher_test
+
+import (
+	"maps"
+	"slices"
+	"testing"
+
+	"sneak.berlin/go/dnswatcher/internal/state"
+	"sneak.berlin/go/dnswatcher/internal/watcher"
+)
+
+// TestRemovedTargetsLeaveTheState loads a state saved while a domain
+// and a hostname now removed from the configuration were still in it,
+// and runs the removal that Run does before the first check. The
+// removed names' domain, hostname and certificate entries are gone,
+// the configured names' are kept, and nothing is notified. Nothing is
+// looked up: the watcher has no resolver.
+func TestRemovedTargetsLeaveTheState(t *testing.T) {
+	t.Parallel()
+
+	const (
+		removedDomain = "example.com"
+		removedHost   = "www.example.com"
+	)
+
+	cfg := defaultTestConfig(t)
+	cfg.Domains = []string{domain}
+	cfg.Hostnames = []string{host}
+
+	deps := newTestDeps(t, cfg)
+	w := watcher.NewForTest(
+		cfg, deps.state, nil,
+		deps.portChecker, deps.tlsChecker, deps.notifier,
+	)
+
+	// The state a check of all four names saves, each name at ip1.
+	for _, name := range []string{domain, removedDomain} {
+		deps.state.SetDomainState(name, &state.DomainState{
+			Nameservers: []string{nsA},
+		})
+	}
+
+	for _, name := range []string{domain, host, removedDomain, removedHost} {
+		deps.state.SetHostnameState(name, saved(
+			map[string]*state.NameserverRecordState{
+				nsA: answered(map[string][]string{"A": {ip1}}),
+			},
+		))
+		deps.state.SetCertificateState(
+			ip1+":443:"+name, &state.CertificateState{Status: "ok"},
+		)
+	}
+
+	err := deps.state.Save()
+	if err != nil {
+		t.Fatalf("saving the state: %v", err)
+	}
+
+	err = deps.state.Load()
+	if err != nil {
+		t.Fatalf("loading the state: %v", err)
+	}
+
+	w.CleanupRemovedTargets()
+
+	snap := deps.state.GetSnapshot()
+
+	got := slices.Sorted(maps.Keys(snap.Domains))
+	if want := []string{domain}; !slices.Equal(got, want) {
+		t.Errorf("domain entries %v, want %v", got, want)
+	}
+
+	got = slices.Sorted(maps.Keys(snap.Hostnames))
+	if want := []string{domain, host}; !slices.Equal(got, want) {
+		t.Errorf("hostname entries %v, want %v", got, want)
+	}
+
+	got = slices.Sorted(maps.Keys(snap.Certificates))
+	if want := []string{
+		ip1 + ":443:" + domain, ip1 + ":443:" + host,
+	}; !slices.Equal(got, want) {
+		t.Errorf("certificate entries %v, want %v", got, want)
+	}
+
+	if sent := deps.notifier.getNotifications(); len(sent) != 0 {
+		t.Errorf("sent %v, want nothing", sent)
+	}
+}
+
+// TestRemovedTargetsLeaveThePortEntries loads a state whose port
+// entries name a domain and a hostname now removed from the
+// configuration, and runs the removal that Run does before the first
+// check. The removed names are off each port entry's list of names, the
+// entry only they had is gone, the entry that also names configured
+// names is kept for the port checks, and nothing is notified.
+func TestRemovedTargetsLeaveThePortEntries(t *testing.T) {
+	t.Parallel()
+
+	const (
+		removedDomain = "example.com"
+		removedHost   = "www.example.com"
+	)
+
+	cfg := defaultTestConfig(t)
+	cfg.Domains = []string{domain}
+	cfg.Hostnames = []string{host}
+
+	deps := newTestDeps(t, cfg)
+	w := watcher.NewForTest(
+		cfg, deps.state, nil,
+		deps.portChecker, deps.tlsChecker, deps.notifier,
+	)
+
+	// The port 443 entries a check of all four names saves: each name
+	// at ip1, except the removed hostname, at ip2.
+	deps.state.SetPortState(ip1+":443", &state.PortState{
+		Open: true, Hostnames: []string{removedDomain, domain, host},
+	})
+	deps.state.SetPortState(ip2+":443", &state.PortState{
+		Open: true, Hostnames: []string{removedHost},
+	})
+
+	err := deps.state.Save()
+	if err != nil {
+		t.Fatalf("saving the state: %v", err)
+	}
+
+	err = deps.state.Load()
+	if err != nil {
+		t.Fatalf("loading the state: %v", err)
+	}
+
+	w.CleanupRemovedTargets()
+
+	if sent := deps.notifier.getNotifications(); len(sent) != 0 {
+		t.Errorf("sent %v, want nothing", sent)
+	}
+
+	snap := deps.state.GetSnapshot()
+
+	got := slices.Sorted(maps.Keys(snap.Ports))
+	if want := []string{ip1 + ":443"}; !slices.Equal(got, want) {
+		t.Fatalf("port entries %v, want %v", got, want)
+	}
+
+	got = snap.Ports[ip1+":443"].Hostnames
+	if want := []string{domain, host}; !slices.Equal(got, want) {
+		t.Errorf("names of port entry %s:443 %v, want %v", ip1, got, want)
+	}
+}
+
+// TestCertificateStateForAnAddressGone runs the port checks on hostname
+// state built here for a configured hostname, with certificate entries
+// saved for it at ip1, ip2 and an IPv6 address. When its nameservers
+// answered with ip1 and the IPv6 address, the entry for ip2 is removed.
+// When none of them answered, its addresses are not known, and every
+// entry is kept. Nothing is notified, and nothing is looked up.
+func TestCertificateStateForAnAddressGone(t *testing.T) {
+	t.Parallel()
+
+	const ip6 = "2001:db8::1"
+
+	tests := []struct {
+		name     string
+		hostname *state.HostnameState
+		want     []string
+	}{
+		{
+			"answered without ip2",
+			saved(map[string]*state.NameserverRecordState{
+				nsA: answered(map[string][]string{
+					"A": {ip1}, "AAAA": {ip6},
+				}),
+			}),
+			[]string{ip1 + ":443:" + host, ip6 + ":443:" + host},
+		},
+		{
+			"no nameserver answered",
+			saved(map[string]*state.NameserverRecordState{
+				nsA: failed(), nsB: failed(),
+			}),
+			[]string{
+				ip1 + ":443:" + host,
+				ip2 + ":443:" + host,
+				ip6 + ":443:" + host,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			cfg := defaultTestConfig(t)
+			cfg.Hostnames = []string{host}
+
+			deps := newTestDeps(t, cfg)
+			w := watcher.NewForTest(
+				cfg, deps.state, nil,
+				deps.portChecker, deps.tlsChecker, deps.notifier,
+			)
+			w.SetFirstRun(false)
+
+			deps.state.SetHostnameState(host, tt.hostname)
+
+			for _, ip := range []string{ip1, ip2, ip6} {
+				deps.state.SetCertificateState(
+					ip+":443:"+host, &state.CertificateState{Status: "ok"},
+				)
+			}
+
+			w.CheckAllPorts(t.Context())
+
+			got := slices.Sorted(maps.Keys(deps.state.GetSnapshot().Certificates))
+			if !slices.Equal(got, tt.want) {
+				t.Errorf("certificate entries %v, want %v", got, tt.want)
+			}
+
+			if sent := deps.notifier.getNotifications(); len(sent) != 0 {
+				t.Errorf("sent %v, want nothing", sent)
+			}
+		})
+	}
+}

internal/watcher/skiprecordnotifications_test.go

@@ -0,0 +1,107 @@
+package watcher_test
+
+import (
+	"slices"
+	"testing"
+
+	"sneak.berlin/go/dnswatcher/internal/config"
+	"sneak.berlin/go/dnswatcher/internal/state"
+	"sneak.berlin/go/dnswatcher/internal/watcher"
+)
+
+// TestSkipRecordNotificationsAlerts runs the hostname change detection
+// for two names on the same check: nsA's address changes, so that nsA
+// now differs from nsB, and nsC stops answering. The name in
+// SkipRecordNotifications gets only the NS Failure; the other name also
+// gets the Record Change and the Inconsistency.
+func TestSkipRecordNotificationsAlerts(t *testing.T) {
+	t.Parallel()
+
+	const skipped = "skipped.example.net"
+
+	prev := saved(map[string]*state.NameserverRecordState{
+		nsA: answered(map[string][]string{"A": {ip1}}),
+		nsB: answered(map[string][]string{"A": {ip1}}),
+		nsC: answered(map[string][]string{"A": {ip1}}),
+	})
+	current := saved(map[string]*state.NameserverRecordState{
+		nsA: answered(map[string][]string{"A": {ip2}}),
+		nsB: answered(map[string][]string{"A": {ip1}}),
+		nsC: failed(),
+	})
+
+	cfg := &config.Config{
+		Hostnames:               []string{host, skipped},
+		SkipRecordNotifications: []string{skipped},
+	}
+
+	// The hostname change detection uses only the configuration and the
+	// notifier.
+	notifier := &mockNotifier{}
+	w := watcher.NewForTest(cfg, nil, nil, nil, nil, notifier)
+
+	w.DetectHostnameChanges(t.Context(), host, prev, current)
+	w.DetectHostnameChanges(t.Context(), skipped, prev, current)
+
+	sent := notifier.getNotifications()
+	titles := make([]string, 0, len(sent))
+
+	for _, n := range sent {
+		titles = append(titles, n.Title)
+	}
+
+	slices.Sort(titles)
+
+	want := []string{
+		"Inconsistency: " + host,
+		"NS Failure: " + skipped,
+		"NS Failure: " + host,
+		"Record Change: " + host,
+	}
+
+	if !slices.Equal(titles, want) {
+		t.Errorf("sent %v, want %v", titles, want)
+	}
+}
+
+// TestSkipRecordNotificationsCheck checks testHost, which is in
+// SkipRecordNotifications, from a saved state in which every nameserver
+// live DNS lists answered with an address live DNS never returns. No
+// Record Change and no Inconsistency is sent, and the check still saves
+// what the nameservers answer.
+func TestSkipRecordNotificationsCheck(t *testing.T) {
+	t.Parallel()
+
+	cfg := defaultTestConfig(t)
+	cfg.Hostnames = []string{testHost}
+	cfg.SkipRecordNotifications = []string{testHost}
+
+	nameservers := lookupNameservers(t, testHost)
+
+	_, deps := runChecks(t, cfg, func(deps *testDeps) {
+		byNameserver := make(map[string]*state.NameserverRecordState)
+		for _, ns := range nameservers {
+			byNameserver[ns] = answered(map[string][]string{"A": {oldIP}})
+		}
+
+		deps.state.SetHostnameState(testHost, saved(byNameserver))
+	})
+
+	for _, title := range []string{
+		"Record Change: " + testHost,
+		"Inconsistency: " + testHost,
+	} {
+		if n := countNotifications(deps, title); n != 0 {
+			t.Errorf("sent %d %q, want 0", n, title)
+		}
+	}
+
+	// A nameserver whose query for A failed keeps oldIP, so the check
+	// is that some address live DNS gave was saved.
+	hs, _ := deps.state.GetHostnameState(testHost)
+	fromLiveDNS := func(ip string) bool { return ip != oldIP }
+
+	if !slices.ContainsFunc(addresses(hs), fromLiveDNS) {
+		t.Errorf("saved addresses %v, want those live DNS gave", addresses(hs))
+	}
+}

internal/watcher/watcher.go

@@ -131,6 +131,7 @@ func (w *Watcher) Run(ctx context.Context) {
 		"tlsInterval", w.config.TLSInterval.String(),
 	)
 
+	w.cleanupRemovedTargets()
 	w.RunOnce(ctx)
 	w.maybeSendTestNotification(ctx)
 
@@ -201,6 +202,59 @@ func (w *Watcher) detectFirstRun() {
 	}
 }
 
+// cleanupRemovedTargets removes from the loaded state the domain,
+// hostname and certificate entries of names no longer in the
+// configuration, which changes only at a restart, and takes those names
+// off each port entry's list of names, removing a port entry left with
+// none. Nothing is notified. A configured domain's own records are
+// saved as a hostname entry under its name, which is kept.
+func (w *Watcher) cleanupRemovedTargets() {
+	for _, name := range w.state.GetAllDomainNames() {
+		if !w.isDomain(name) {
+			w.state.DeleteDomainState(name)
+		}
+	}
+
+	for _, name := range w.state.GetAllHostnames() {
+		if !w.isConfigured(name) {
+			w.state.DeleteHostnameState(name)
+		}
+	}
+
+	for _, key := range w.state.GetAllCertificateKeys() {
+		if _, hostname := parseCertKey(key); !w.isConfigured(hostname) {
+			w.state.DeleteCertificateState(key)
+		}
+	}
+
+	for _, key := range w.state.GetAllPortKeys() {
+		ps, ok := w.state.GetPortState(key)
+		if !ok {
+			continue
+		}
+
+		var names []string
+
+		for _, name := range ps.Hostnames {
+			if w.isConfigured(name) {
+				names = append(names, name)
+			}
+		}
+
+		if len(names) == 0 {
+			w.state.DeletePortState(key)
+
+			continue
+		}
+
+		w.state.SetPortState(key, &state.PortState{
+			Open:        ps.Open,
+			Hostnames:   names,
+			LastChecked: ps.LastChecked,
+		})
+	}
+}
+
 // runDNSChecks performs DNS resolution for all configured domains
 // and hostnames, updating state with freshly resolved records.
 // This must complete before port or TLS checks run so those
@@ -235,6 +289,13 @@ func (w *Watcher) checkDomain(
 	domain string,
 ) {
 	nameservers, err := w.resolver.LookupNS(ctx, domain)
+
+	// A domain that does not exist has no nameservers.
+	nxdomain := errors.Is(err, resolver.ErrNXDomain)
+	if nxdomain {
+		nameservers, err = []string{}, nil
+	}
+
 	if err != nil {
 		w.logFailedLookup(
 			ctx,
@@ -269,9 +330,18 @@ func (w *Watcher) checkDomain(
 	w.state.SetDomainState(domain, &state.DomainState{
 		Nameservers:         nameservers,
 		NameserverAddresses: addresses,
+		NXDomain:            nxdomain,
 		LastChecked:         now,
 	})
 
+	// A domain that does not exist has no records of its own: none are
+	// asked for, and those saved by an earlier check are removed.
+	if nxdomain {
+		w.state.DeleteHostnameState(domain)
+
+		return
+	}
+
 	// The apex domain's records are also checked and saved as a
 	// hostname's, so that the port and TLS checks find its addresses.
 	// Notifications about them name it as a domain (see nameLine).
@@ -581,17 +651,50 @@ func (w *Watcher) detectHostnameChanges(
 	w.detectCNAMEAddressChanges(ctx, hostname, prev, current)
 }
 
+// isDomain reports whether name is a configured apex domain, whose own
+// records are checked and saved as a hostname's are.
+func (w *Watcher) isDomain(name string) bool {
+	return slices.Contains(w.config.Domains, name)
+}
+
 // nameLine is the line a notification about name's records starts with:
-// "Domain: " and the name for a configured apex domain, whose own
-// records are checked as a hostname's are, and "Hostname: " otherwise.
+// "Domain: " and the name for a configured apex domain, and
+// "Hostname: " otherwise.
 func (w *Watcher) nameLine(name string) string {
-	if slices.Contains(w.config.Domains, name) {
+	if w.isDomain(name) {
 		return "Domain: " + name
 	}
 
 	return "Hostname: " + name
 }
 
+// portNameLines lists the names that resolve to a port's address, the
+// configured apex domains on one line and the hostnames on the next,
+// leaving out a line that would name nothing.
+func (w *Watcher) portNameLines(names []string) string {
+	var domains, hostnames []string
+
+	for _, name := range names {
+		if w.isDomain(name) {
+			domains = append(domains, name)
+		} else {
+			hostnames = append(hostnames, name)
+		}
+	}
+
+	var lines []string
+
+	if len(domains) > 0 {
+		lines = append(lines, "Domains: "+strings.Join(domains, ", "))
+	}
+
+	if len(hostnames) > 0 {
+		lines = append(lines, "Hostnames: "+strings.Join(hostnames, ", "))
+	}
+
+	return strings.Join(lines, "\n")
+}
+
 // detectCNAMEAddressChanges notifies when the addresses at the end of
 // hostname's CNAME chain differ from those the previous check saved,
 // including a change from or to none. When the previous addresses are
@@ -627,12 +730,16 @@ func (w *Watcher) detectCNAMEAddressChanges(
 // failed on either check has no records to compare. The records kept
 // for a record type whose query failed are compared too, but not those
 // of a type in UnknownTypes on either check, which the message leaves
-// out as well.
+// out as well. Nothing is sent for a name in SkipRecordNotifications.
 func (w *Watcher) detectRecordChanges(
 	ctx context.Context,
 	hostname string,
 	prev, current *state.HostnameState,
 ) {
+	if slices.Contains(w.config.SkipRecordNotifications, hostname) {
+		return
+	}
+
 	for ns, cur := range current.RecordsByNameserver {
 		prevNS, ok := prev.RecordsByNameserver[ns]
 		if !ok || prevNS.Status != statusOK || cur.Status != statusOK {
@@ -732,11 +839,18 @@ func (w *Watcher) detectNSFailures(
 	}
 }
 
+// detectInconsistencies notifies each pair of nameservers that newly
+// disagree (see newlyDisagreeingPairs). Nothing is sent for a name in
+// SkipRecordNotifications.
 func (w *Watcher) detectInconsistencies(
 	ctx context.Context,
 	hostname string,
 	prev, current *state.HostnameState,
 ) {
+	if slices.Contains(w.config.SkipRecordNotifications, hostname) {
+		return
+	}
+
 	for _, pair := range newlyDisagreeingPairs(prev, current) {
 		ns1, ns2 := pair[0], pair[1]
 		state1 := current.RecordsByNameserver[ns1]
@@ -828,8 +942,10 @@ func (w *Watcher) checkAllPorts(ctx context.Context) {
 	}
 
 	// Phase 3: Remove port state entries that no longer have
-	// any hostname referencing them.
+	// any hostname referencing them, and certificate entries for
+	// an address their name no longer has.
 	w.cleanupStalePorts(associations)
+	w.cleanupStaleCertificates()
 }
 
 // buildPortAssociations constructs a map from IP:port keys to
@@ -913,11 +1029,45 @@ func (w *Watcher) cleanupStalePorts(
 	}
 }
 
+// cleanupStaleCertificates removes the certificate entries for an
+// address their name no longer resolves to. An entry saved for a name
+// none of whose nameservers answered is kept: that name's addresses are
+// not known, not gone.
+func (w *Watcher) cleanupStaleCertificates() {
+	for _, key := range w.state.GetAllCertificateKeys() {
+		ip, hostname := parseCertKey(key)
+
+		if slices.Contains(w.collectIPs(hostname), ip) ||
+			w.noNameserverAnswered(hostname) {
+			continue
+		}
+
+		w.state.DeleteCertificateState(key)
+	}
+}
+
+// parseCertKey splits an "ip:port:hostname" certificate key into its
+// address and hostname.
+func parseCertKey(key string) (string, string) {
+	lastColon := strings.LastIndex(key, ":")
+	if lastColon < 0 {
+		return "", key
+	}
+
+	ip, _ := parsePortKey(key[:lastColon])
+
+	return ip, key[lastColon+1:]
+}
+
+// isConfigured reports whether name is a configured domain or hostname.
+func (w *Watcher) isConfigured(name string) bool {
+	return w.isDomain(name) || slices.Contains(w.config.Hostnames, name)
+}
+
 // noNameserverAnswered reports whether name is a configured domain or
 // hostname and none of its nameservers answered on its last check.
 func (w *Watcher) noNameserverAnswered(name string) bool {
-	if !slices.Contains(w.config.Hostnames, name) &&
-		!slices.Contains(w.config.Domains, name) {
+	if !w.isConfigured(name) {
 		return false
 	}
 
@@ -1006,8 +1156,8 @@ func (w *Watcher) checkSinglePort(
 		}
 
 		msg := fmt.Sprintf(
-			"Hosts: %s\nAddress: %s\nPort now %s",
-			strings.Join(hostnames, ", "), key, stateStr,
+			"%s\nAddress: %s\nPort now %s",
+			w.portNameLines(hostnames), key, stateStr,
 		)
 
 		w.notify.SendNotification(

internal/watcher/watcher_test.go

@@ -482,6 +482,119 @@ func TestNSChangeDetection(t *testing.T) {
 	}
 }
 
+// TestDomainThatDoesNotExist checks a .com domain that does not exist,
+// with nameservers and records saved by an earlier check. The .com
+// servers answer that it does not exist, so it is saved with nxdomain
+// set and no nameservers, an NS Change removes them all, and its saved
+// records are removed rather than asked for at the .com servers.
+func TestDomainThatDoesNotExist(t *testing.T) {
+	t.Parallel()
+
+	const domain = "dnswatcher-test-does-not-exist.com"
+
+	cfg := defaultTestConfig(t)
+	cfg.Domains = []string{domain}
+
+	var deps *testDeps
+
+	livednstest.Retry(t, "watcher checks", func(ctx context.Context) error {
+		var w *watcher.Watcher
+
+		w, deps = newTestWatcher(t, cfg)
+
+		deps.state.SetDomainState(domain, &state.DomainState{
+			Nameservers: []string{oldNS1, oldNS2},
+		})
+		deps.state.SetHostnameState(domain, &state.HostnameState{
+			RecordsByNameserver: map[string]*state.NameserverRecordState{
+				oldNS1: {
+					Records: map[string][]string{"A": {oldIP}},
+					Status:  "ok",
+				},
+			},
+		})
+
+		started := time.Now()
+
+		w.RunOnce(ctx)
+
+		// When no server answered, the domain's state is not saved.
+		ds, _ := deps.state.GetDomainState(domain)
+		if ds.LastChecked.Before(started) {
+			return fmt.Errorf("%s: %w", domain, livednstest.ErrNoAnswer)
+		}
+
+		return nil
+	})
+
+	ds, _ := deps.state.GetDomainState(domain)
+	if !ds.NXDomain || len(ds.Nameservers) != 0 {
+		t.Errorf("saved nxdomain %v and nameservers %v, want true and none",
+			ds.NXDomain, ds.Nameservers)
+	}
+
+	if hs, ok := deps.state.GetHostnameState(domain); ok {
+		t.Errorf("records saved for %s: %v", domain, hs.RecordsByNameserver)
+	}
+
+	assertNotified(t, deps, "NS Change: "+domain, "warning")
+
+	// That is the only notification, and it removes both nameservers,
+	// in either order.
+	for _, n := range deps.notifier.getNotifications() {
+		removed := strings.TrimPrefix(
+			n.Message, "Domain: "+domain+"\nAdded: \nRemoved: ",
+		)
+		if removed != oldNS1+", "+oldNS2 && removed != oldNS2+", "+oldNS1 {
+			t.Errorf("unexpected notification: %v", n)
+		}
+	}
+}
+
+// TestDomainWithNoDelegationOfItsOwn checks a domain with no delegation
+// of its own: codeberg.page is on the public suffix list, so
+// docs.codeberg.page is a domain, but the .page servers delegate only
+// codeberg.page, whose servers answer for it. It is saved with no
+// nameservers and without nxdomain, and its records, asked at the
+// codeberg.page servers, are saved. Those are testSmallDomain's two
+// nameservers; github.io, the zone of the README's example, has eight.
+func TestDomainWithNoDelegationOfItsOwn(t *testing.T) {
+	t.Parallel()
+
+	const domain = "docs.codeberg.page"
+
+	cfg := defaultTestConfig(t)
+	cfg.Domains = []string{domain}
+
+	var deps *testDeps
+
+	livednstest.Retry(t, "watcher checks", func(ctx context.Context) error {
+		var w *watcher.Watcher
+
+		w, deps = newTestWatcher(t, cfg)
+
+		err := checkOnce(ctx, w, deps)
+
+		// A domain saved as not existing has no records to wait for;
+		// the checks below fail on it.
+		if ds, ok := deps.state.GetDomainState(domain); ok && ds.NXDomain {
+			return nil
+		}
+
+		return err
+	})
+
+	ds, _ := deps.state.GetDomainState(domain)
+	if ds.NXDomain || len(ds.Nameservers) != 0 {
+		t.Errorf("saved nxdomain %v and nameservers %v, want false and none",
+			ds.NXDomain, ds.Nameservers)
+	}
+
+	if _, ok := deps.state.GetHostnameState(domain); !ok {
+		t.Errorf("no records saved for %s", domain)
+	}
+}
+
 func TestNSAddressChangeDetection(t *testing.T) {
 	t.Parallel()
 

script/bootstrap

@@ -3,12 +3,12 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes nothing is present.
-# goimports is not installed here: script/fmt and script/fmt-check-go
-# run it with `go run` at a pinned commit.
+# goimports is not installed here: script/fmt and script/fmt-check run
+# it with `go run` at a pinned commit.
 # The linter is NOT installed here: golangci-lint runs via docker only
 # (script/lint), pinned by image digest, so its only prerequisite is a
-# working docker. Nor is prettier: script/fmt and
-# script/fmt-check-markdown run it in a container from Dockerfile.fmt.
+# working docker. Nor is prettier: script/fmt and script/fmt-check run
+# it in a stage of the Dockerfile.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -67,12 +67,12 @@ main() {
     if missing make; then pkg_install gnumake make make make; fi
     if missing go; then pkg_install go golang go go; fi
 
-    # Linting and the markdown formatter run via docker only. Warn,
-    # don't fail: building and testing work without it.
+    # Testing, linting and the markdown formatter run via docker only.
+    # Warn, don't fail: make build works without it.
     if missing docker; then
         echo "bootstrap: WARNING: docker not found; install it to" \
-            "run make lint, make fmt, make fmt-check, make check" \
-            "and make docker." >&2
+            "run make test, make lint, make fmt, make fmt-check," \
+            "make check and make docker." >&2
     fi
 
     go mod download

script/cibuild

@@ -1,14 +1,10 @@
 #!/bin/sh
-# script/cibuild: run the CI build. The Dockerfile's lint stage runs
-# the Go half of make fmt-check and golangci-lint; its builder stage
-# runs make test and make build. The markdown half of make fmt-check
-# runs after that build, as its own build of Dockerfile.fmt, because
-# there is no docker inside a docker build.
-#
-# --no-cache-filter=lint,builder runs both stages on every invocation;
-# otherwise an unchanged tree is served from the layer cache and passes
-# without linting or querying live DNS. script/fmt-check-markdown busts
-# its own cache the same way.
+# script/cibuild: run the CI build. It bootstraps first: a CI runner
+# checks out and runs this and nothing else, and script/fmt-check runs
+# the formatter on the host, which a pristine checkout cannot do.
+# --no-cache for the same reason as script/docker: the gate phases the
+# final stage depends on are RUN steps, and a cached one is a check that
+# did not run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -16,8 +12,17 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build --no-cache-filter=lint,builder .
-    "$SCRIPT_DIR/fmt-check-markdown"
+    "$SCRIPT_DIR/bootstrap"
+    "$SCRIPT_DIR/check"
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$("$SCRIPT_DIR/projectname")" .
 }
 
 main "$@"

script/docker

@@ -1,10 +1,8 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
-# The tag comes from script/projectname.
-#
-# --no-cache-filter=lint,builder runs the lint stage and the builder
-# stage (make test) on every invocation; otherwise an unchanged tree is
-# served from the layer cache without linting or querying live DNS.
+# Identical in all repos; the tag comes from script/projectname.
+# --no-cache because the gate phases the final stage depends on are RUN
+# steps, and a cached one is a check that did not run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -14,11 +12,11 @@ main() {
     cd "$ROOT"
     # Own line: a failing command substitution inside an argument does
     # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. The VERSION build arg takes precedence over what
-    # the build would derive from the .git in its context.
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
-    docker build --no-cache-filter=lint,builder \
+    docker build --no-cache \
         --build-arg VERSION="$version" \
         -t "$("$SCRIPT_DIR/projectname")" .
 }

script/fmt

@@ -1,6 +1,6 @@
 #!/bin/sh
 # script/fmt: format all files (writes). Go with gofmt and goimports on
-# the host, markdown with the prettier pinned by Dockerfile.fmt.
+# the host, markdown with prettier in the Dockerfile's fmt stage.
 #
 # goimports runs with `go run` at a pinned commit, never from PATH, so
 # every machine formats with the same version and nothing installs it.
@@ -8,21 +8,15 @@
 # The markdown pass is a `docker build --output type=local` rather than a
 # `docker run -v`, so it needs no bind mount and behaves the same against
 # a remote daemon; the formatted documents come back out of the build and
-# are copied over the tree here.
-#
-# Unlike script/fmt-check-markdown this does not bust the cache: it is
-# not a gate, and any edit to a document changes the COPY layer above the
-# prettier step, so a cached result is a result over this exact tree.
+# are copied over the tree here. --output writes files and makes no
+# image, so there is nothing to tag.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# goimports v0.42.0, 2026-08-07. Must match script/fmt-check-go.
+# goimports v0.42.0, 2026-08-07. Must match script/fmt-check.
 GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
 
-# Must match the export stage name in Dockerfile.fmt.
-stage=fmt-out
-
 die() {
     echo "script/fmt: $*" >&2
     exit 1
@@ -36,10 +30,9 @@ main() {
     tmp="$(mktemp -d "${TMPDIR:-/tmp}/dnswatcher-fmt.XXXXXX")"
     trap 'rm -rf "$tmp"' EXIT INT TERM
 
-    docker build \
-        --target "$stage" \
-        --output "type=local,dest=$tmp/out" \
-        -f Dockerfile.fmt .
+    docker build --no-cache \
+        --target fmt-out \
+        --output "type=local,dest=$tmp/out" .
 
     # An empty export means prettier was handed nothing, which must not
     # read as "already formatted".

script/fmt-check

@@ -1,14 +1,37 @@
 #!/bin/sh
 # script/fmt-check: check formatting (read-only). Same tools and scope
-# as script/fmt, but fails instead of writing: the Go on the host, the
-# markdown with prettier in a container.
+# as script/fmt, but fails instead of writing and names what it would
+# change: the Go on the host, the markdown with prettier in the
+# Dockerfile's fmt-check stage.
+#
+# --no-cache because a cached check layer is a check that did not run.
+# The tag makes each build replace the previous image instead of leaving
+# a dangling one behind.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+# goimports v0.42.0, 2026-08-07. Must match script/fmt.
+GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
 
 main() {
-    "$SCRIPT_DIR/fmt-check-go"
-    "$SCRIPT_DIR/fmt-check-markdown"
+    cd "$ROOT"
+    files="$(gofmt -s -l .)"
+    if [ -n "$files" ]; then
+        echo "gofmt: files not formatted:" >&2
+        echo "$files" >&2
+        exit 1
+    fi
+    files="$(go run "$GOIMPORTS_REF" -l .)"
+    if [ -n "$files" ]; then
+        echo "goimports: files not formatted:" >&2
+        echo "$files" >&2
+        exit 1
+    fi
+    docker build --no-cache \
+        --target fmt-check \
+        -t "$("$SCRIPT_DIR/projectname")-fmt-check" .
 }
 
 main "$@"

script/fmt-check-go

@@ -1,31 +0,0 @@
-#!/bin/sh
-# script/fmt-check-go: fail unless every Go source is formatted the way
-# script/fmt would leave it, and name the files that are not. Read-only.
-#
-# Its own script because the Dockerfile's lint stage runs this half
-# alone: there is no docker inside a docker build to run the markdown
-# half in.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# goimports v0.42.0, 2026-08-07. Must match script/fmt.
-GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
-
-main() {
-    cd "$ROOT"
-    files="$(gofmt -s -l .)"
-    if [ -n "$files" ]; then
-        echo "gofmt: files not formatted:" >&2
-        echo "$files" >&2
-        exit 1
-    fi
-    files="$(go run "$GOIMPORTS_REF" -l .)"
-    if [ -n "$files" ]; then
-        echo "goimports: files not formatted:" >&2
-        echo "$files" >&2
-        exit 1
-    fi
-}
-
-main "$@"

script/fmt-check-markdown

@@ -1,29 +0,0 @@
-#!/bin/sh
-# script/fmt-check-markdown: fail unless every .md is formatted the way
-# script/fmt would leave it. Read-only.
-#
-# prettier is never installed on the host: it runs in a container built
-# from Dockerfile.fmt, pinned by package.json and yarn.lock.
-# --no-cache-filter is here for the reason script/lint gives: a cached
-# build checks nothing.
-#
-# Its own script because script/cibuild runs this half alone, after the
-# Dockerfile's lint stage has checked the Go.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Must match the markdown check stage name in Dockerfile.fmt.
-stage=fmt-check
-
-main() {
-    cd "$ROOT"
-    docker build \
-        --progress=plain \
-        --no-cache-filter="$stage" \
-        --target "$stage" \
-        -f Dockerfile.fmt \
-        .
-}
-
-main "$@"

script/lint

@@ -1,28 +1,23 @@
 #!/bin/sh
-# script/lint: run the linter. golangci-lint is never installed or run
-# on the host: it runs via docker only, one way, everywhere. This
-# builds Dockerfile.lint, which COPYs the repo into the digest-pinned
-# golangci-lint image and lints as a build step, so a successful build
-# means a clean lint.
+# script/lint: run the linter. Linting is a phase of the Dockerfile and
+# this builds that phase alone; the linter is never installed or run on
+# a developer host, where a shared result cache and a host-global lock
+# make its answer untrustworthy.
 #
-# --no-cache-filter=lint forces the lint stage (source copy + linter
-# run) to execute on every invocation. Without it an unchanged tree
-# returns success in well under a second having linted nothing. The
-# deps stage (base image + go mod download) stays cached, and no global
-# cache invalidation is performed. --progress=plain keeps the linter's
-# own output visible.
+# The phase is not the last stage in the file, so it is built only when
+# --target names it. --no-cache because a cached lint layer is a lint
+# that did not run. The tag makes each build replace the previous image
+# instead of leaving a dangling one behind.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build \
-        --progress=plain \
-        --no-cache-filter=lint \
+    docker build --no-cache \
         --target lint \
-        -f Dockerfile.lint \
-        .
+        -t "$("$SCRIPT_DIR/projectname")-lint" .
 }
 
 main "$@"

script/test

@@ -1,35 +1,19 @@
 #!/bin/sh
-# script/test: run the test suite.
-#
-# -count=1 disables Go's test cache, and is load-bearing here. This
-# suite queries live DNS on every run by policy (TESTING.md); a cached
-# result is a replay of an earlier run's output with no query made at
-# all. On an unchanged tree the whole suite would return success in
-# under a second having resolved nothing, which makes the repeated-run
-# green that is used as evidence for flakiness fixes worthless. Do not
-# remove it.
-#
-# Conditional verbose rerun per REPO_POLICIES.md: run quiet first so
-# CI and docker build logs stay readable, and rerun with -v only on
-# failure. The rerun also carries -count=1 (a cached replay of the
-# failure would show nothing new), and the exit status is forced to 1
-# no matter how the rerun ends: the first failure already proved the
-# suite broken, so a flaky test that passes the second time must not
-# turn the build green.
-#
-# -timeout 90s is a deliberate backstop above the 60s hard cap on
-# suite duration. Do not lower it.
+# script/test: run the test suite. Testing is a phase of the Dockerfile
+# and this builds that phase alone, on the same terms as script/lint:
+# --target because a phase that is not the last stage is built only when
+# named, --no-cache because a cached test layer is a test that did not
+# run, and a tag so each build replaces the previous image.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    go test -count=1 -race -timeout 90s -cover ./... || {
-        echo "--- Rerunning with -v for details ---" >&2
-        go test -count=1 -race -timeout 90s -v ./... || true
-        exit 1
-    }
+    docker build --no-cache \
+        --target test \
+        -t "$("$SCRIPT_DIR/projectname")-test" .
 }
 
 main "$@"