watcher: follow a watched name's CNAME for port and TLS checks (closes #203)

When a watched name's nameservers answer with a CNAME and no address,
the DNS check follows every CNAME target they gave with
ResolveIPAddresses and saves the addresses found for all of them in the
hostname state as cnameAddresses, so nameservers that disagree on the
target do not change them from check to check. The port and TLS checks
use them. A change in them is notified as a CNAME address change, also
from or to none. A state file without the field loads them as not known
(nil), so its first check sends nothing for them. When a target cannot
be followed, or none of the name's nameservers answered, the last
check's addresses are kept. The domain check now runs the hostname
check for the apex instead of a copy of it.

Model: opus-5-5

.dockerignore

@@ -1,9 +1,9 @@
-# .git is sent, without its config: the builder stage derives the version it
-# stamps into the binary from it, and `git describe` does not need the config,
-# which can hold a credential (a password in the remote URL, a CI token). No
-# tracked file may be listed here: git in the build would see it as deleted
-# and mark the version -dirty, and an excluded .md would silently drop out of
-# the prettier check in Dockerfile.fmt.
-.git/config
+.git/
 bin/
 node_modules/
+# No .md may be excluded: Dockerfile.fmt checks every document with
+# prettier, and an exclusion here would drop a file from that check while
+# prettier still reports every file it was handed clean.
+LICENSE
+.editorconfig
+.gitignore

.gitea/workflows/check.yml

@@ -1,17 +1,9 @@
 name: check
 on: [push]
-# A new push to a branch cancels that branch's older run, queued or running;
-# runs on other branches, `next` and `main` among them, are left alone.
-concurrency:
-    group: ${{ github.workflow }}-${{ github.ref }}
-    cancel-in-progress: true
 jobs:
     check:
         runs-on: ubuntu-latest
         steps:
             # actions/checkout v4.2.2, 2026-02-28
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-              # script/cibuild needs no token, so none is left in .git/config.
-              with:
-                  persist-credentials: false
             - run: script/cibuild

Dockerfile

@@ -24,11 +24,6 @@ FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4
 
 RUN apk add --no-cache git make gcc musl-dev binutils-gold
 
-# A build context sent as a tar archive keeps its files' owners, and git
-# refuses to read a checkout owned by another user. Trust this one
-# whoever owns it.
-RUN git config --system --add safe.directory /src
-
 # Force BuildKit to run the lint stage before proceeding
 COPY --from=lint /src/go.sum /dev/null
 
@@ -41,26 +36,11 @@ COPY . .
 # Run the tests - build fails if any test fails
 RUN make test
 
-# Version stamped into the binary: the VERSION build arg when one is
-# given and not empty (script/docker passes one), otherwise what
-# `git describe` says of the .git in the build context, so a plain
-# `docker build .` of a clone stamps its tag or short commit. The build
-# arg reaches make through the environment.
-ARG VERSION
-
-# A context that carries .git, as a directory or as a file, must yield a
-# real version: one that is empty, `dev` or `unknown` cannot be traced
-# back to a commit.
-RUN version="$(make version)"; \
-    if [ -e .git ]; then \
-        case "$version" in \
-            "" | dev | unknown) \
-                echo "version is \"$version\" although the build context carries .git" >&2; \
-                exit 1 ;; \
-        esac; \
-    fi
-
-RUN make build
+# Build the binary. .dockerignore leaves out .git, so `git describe` in
+# the Makefile cannot find the version here: script/docker passes it as
+# --build-arg VERSION, and a build that passes none reports `dev`.
+ARG VERSION=dev
+RUN make build VERSION="${VERSION}"
 
 # Runtime stage
 # alpine 3.21, 2026-02-28

Dockerfile.fmt

@@ -30,8 +30,9 @@ COPY . .
 # --config, not discovery: a .prettierrc that failed to arrive would
 # otherwise leave prettier on its defaults, where proseWrap is "preserve"
 # and every wrap this check exists to enforce passes. Missing the file is
-# a hard error instead. --no-editorconfig so that .prettierrc alone sets
-# the style.
+# a hard error instead. --no-editorconfig for the same reason in reverse:
+# .editorconfig is not in the build context, so honouring it here and on
+# a developer's machine would be two different answers.
 RUN prettier --config .prettierrc --no-editorconfig --check "**/*.md"
 
 # Write path. Not a check: script/fmt builds this and takes the files.

Makefile

@@ -1,13 +1,9 @@
-.PHONY: all bootstrap setup build version lint fmt fmt-check test check clean hooks docker
+.PHONY: all bootstrap setup build lint fmt fmt-check test check clean hooks docker
 
 BINARY := dnswatcher
-# VERSION given on the command line (`make build VERSION=...`) or in the
-# environment, which is how the Dockerfile's VERSION build arg arrives,
-# wins over what `git describe` says of this checkout. An empty one counts
-# as not given; `override` is what replaces an empty command-line value.
-ifeq ($(VERSION),)
-override VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
-endif
+# `make build VERSION=...` overrides this; the Dockerfile does so, as the
+# image has no .git to describe.
+VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
 LDFLAGS := -X main.Version=$(VERSION)
 
 # Standard targets are thin shims; the implementations live in script/
@@ -25,10 +21,6 @@ setup:
 build:
 	go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/dnswatcher
 
-# Prints the version `make build` stamps; the Dockerfile checks it.
-version:
-	@echo "$(VERSION)"
-
 test:
 	@script/test
 

README.md

@@ -599,7 +599,6 @@ provide:
 
 ```sh
 make build      # Build binary to bin/dnswatcher
-make version    # Print the version make build stamps
 make test       # Run tests with race detector
 make lint       # Run golangci-lint in Docker (requires docker)
 make fmt        # Format code and Markdown (requires docker)
@@ -610,26 +609,13 @@ make clean      # Remove build artifacts
 ### Build-Time Variables
 
 `make build` sets the version with `-ldflags "-X main.Version=..."`, taking it
-from `VERSION` when given on the command line (`make build VERSION=1.2.3`) or in
-the environment, otherwise from `git describe --tags --always --dirty`, and
-`dev` without git metadata. An empty `VERSION` counts as not given. The version
-appears in the startup log and in the health check response.
+from `git describe --tags --always --dirty`, or from `VERSION` when given on the
+command line (`make build VERSION=1.2.3`). The version appears in the startup
+log and in the health check response.
 
-The image takes it the same way, from the `.git` the build context carries, so a
-plain `docker build .` of a clone stamps the commit it was built from; a clone
-without tags stamps the short commit. A clone made with `--depth 1` carries at
-most a tag on its own commit, so such a clone of an untagged commit stamps the
-short commit. In a build from a directory, `.dockerignore` keeps out
-`.git/config`, which `git describe` does not need and which can hold a
-credential. Docker does not apply `.dockerignore` to a context sent as a tar
-archive, as upaas sends it, so that context carries `.git/config` into the
-build. It also keeps its files' owners, so git in the build trusts the checkout
-whoever owns it. A non-empty `--build-arg VERSION=...` takes precedence;
-`make docker` passes the version `git describe` gives on the host. The build
-fails when the context carries `.git`, as a directory or as a file, and the
-version comes out empty, `dev` or `unknown`. `.dockerignore` must list no
-tracked file: git in the build would see it as deleted and mark the version
-`-dirty`.
+The Docker image has no `.git`, so the `Dockerfile` takes the version as
+`--build-arg VERSION`. `make docker` passes it; a plain `docker build` passes
+none, and that image reports `dev`.
 
 ---
 

TODO.md

@@ -21,14 +21,6 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 - 2026-10-02: a watched name whose nameservers answer with a CNAME and no
   address gets port and TLS checks at the end of its CNAME chain (closes #203).
-- 2026-10-02: a plain `docker build .` of a clone stamps its tag or short
-  commit, not `dev`: the build context now carries `.git` (closes #210).
-- 2026-10-02: a query a server refuses is not resent asking for recursion, and
-  every root server refusing is reported as DNS interception (closes #206).
-- 2026-10-02: a push to a branch cancels that branch's older CI run, and the
-  checkout leaves no token in `.git/config` (closes #216).
-- 2026-10-02: watcher tests send far fewer queries and a live attempt may take
-  18s; nameserver addresses are asked only for A, AAAA, CNAME (closes #214).
 - 2026-10-02: the resolver tries root servers, and every other server list it
   walks, in a random order each time, not always from the top (closes #138).
 - 2026-10-02: a name listed more than once in `DNSWATCHER_TARGETS`, in any

internal/livednstest/livednstest.go

@@ -36,18 +36,11 @@ const (
 	// before the test fails.
 	attempts = 3
 
-	// AttemptTimeout bounds one attempt. It must fit the longest
-	// operation, a watcher check, which sends over a hundred queries one
-	// after another and on a slow build host takes several times as long
-	// as the few seconds it takes on a fast one. An operation whose
-	// every attempt fails takes attempts * AttemptTimeout plus the
-	// backoff, about 56 seconds, after it waits for one of the
-	// Concurrency slots that every live operation in the test binary
-	// shares. So when live DNS does not answer at all, a test binary
-	// with more live operations than slots runs into the 90-second
-	// `go test -timeout` backstop instead of each test failing on its
-	// own.
-	AttemptTimeout = 18 * time.Second
+	// AttemptTimeout bounds one attempt. Worst case for an operation
+	// is attempts * AttemptTimeout plus the backoff — about 26
+	// seconds, well inside the 90-second `go test -timeout` backstop
+	// even when several operations exhaust their attempts.
+	AttemptTimeout = 8 * time.Second
 
 	// backoffBase is the delay after the first failed attempt; it is
 	// multiplied by backoffFactor each time.

internal/resolver/errors.go

@@ -22,11 +22,6 @@ var (
 		"reply is an error or a referral that leads no closer",
 	)
 
-	// ErrIntercepted is returned when every root server refused a
-	// query. Root servers refuse no query, so the refusals came from
-	// something on the network answering in their place.
-	ErrIntercepted = errors.New("this network intercepts DNS queries")
-
 	// ErrCNAMEDepthExceeded is returned when a CNAME chain
 	// exceeds MaxCNAMEDepth.
 	ErrCNAMEDepthExceeded = errors.New(

internal/resolver/export_test.go

@@ -28,24 +28,13 @@ func CollectIPs(
 	return collectIPs(results)
 }
 
-// QueryServers exports queryServers for testing.
-func (r *Resolver) QueryServers(
-	ctx context.Context,
-	servers []string,
-	zone string,
-	name string,
-	qtype uint16,
-) (*dns.Msg, error) {
-	return r.queryServers(ctx, servers, zone, name, qtype)
-}
-
 // QueryEachNS exports queryEachNS for testing.
 func (r *Resolver) QueryEachNS(
 	ctx context.Context,
 	nameservers []string,
 	hostname string,
 ) (map[string]*NameserverResponse, error) {
-	return r.queryEachNS(ctx, nameservers, hostname, recordTypes())
+	return r.queryEachNS(ctx, nameservers, hostname)
 }
 
 // ResolveNSIPs exports resolveNSIPs for testing.

internal/resolver/iterative.go

@@ -107,8 +107,9 @@ func (r *Resolver) retryTCP(
 	return resp
 }
 
-// queryDNS sends a DNS query to a specific server IP, never asking it
-// for recursion. A reply of REFUSED is returned as ErrRefused.
+// queryDNS sends a DNS query to a specific server IP.
+// Tries non-recursive first, falls back to recursive on
+// REFUSED (handles DNS interception environments).
 func (r *Resolver) queryDNS(
 	ctx context.Context,
 	serverIP string,
@@ -131,13 +132,26 @@ func (r *Resolver) queryDNS(
 		return nil, fmt.Errorf("query %s @%s: %w", name, serverIP, err)
 	}
 
+	if resp.Rcode == dns.RcodeRefused {
+		msg.RecursionDesired = true
+
+		resp, err = r.tryExchange(ctx, msg, addr)
+		if err != nil {
+			return nil, fmt.Errorf(
+				"query %s @%s: %w", name, serverIP, err,
+			)
+		}
+
 		if resp.Rcode == dns.RcodeRefused {
 			return nil, fmt.Errorf(
 				"query %s @%s: %w", name, serverIP, ErrRefused,
 			)
 		}
+	}
 
-	return r.retryTCP(ctx, msg, addr, resp), nil
+	resp = r.retryTCP(ctx, msg, addr, resp)
+
+	return resp, nil
 }
 
 func extractNSSet(rrs []dns.RR) []string {
@@ -265,9 +279,7 @@ func shuffled(
 
 // queryServers asks servers, the servers of zone, about name in a random
 // order until one gives a usable reply. A server that times out, refuses
-// or gives a reply that is not usable is passed over for the next. When
-// every server refused, the error says so, and when they are the root
-// servers it is ErrIntercepted.
+// or gives a reply that is not usable is passed over for the next.
 func (r *Resolver) queryServers(
 	ctx context.Context,
 	servers []string,
@@ -277,8 +289,6 @@ func (r *Resolver) queryServers(
 ) (*dns.Msg, error) {
 	var lastErr error
 
-	refused := 0
-
 	for _, ip := range shuffled(servers, rand.Shuffle) {
 		if checkCtx(ctx) != nil {
 			return nil, ErrContextCanceled
@@ -295,27 +305,9 @@ func (r *Resolver) queryServers(
 			return resp, nil
 		}
 
-		if errors.Is(err, ErrRefused) {
-			refused++
-		}
-
 		lastErr = err
 	}
 
-	if refused == len(servers) && zone == "." {
-		return nil, fmt.Errorf(
-			"every root server refused a query for %s: %w",
-			name, ErrIntercepted,
-		)
-	}
-
-	if refused == len(servers) {
-		return nil, fmt.Errorf(
-			"every server of %s refused a query for %s: %w",
-			zone, name, ErrRefused,
-		)
-	}
-
 	return nil, fmt.Errorf("all servers failed: %w", lastErr)
 }
 
@@ -536,49 +528,17 @@ func (r *Resolver) FindAuthoritativeNameservers(
 
 			return nsNames, nil
 		}
-
-		// The root servers would refuse every parent name too.
-		if errors.Is(err, ErrIntercepted) {
-			return nil, err
-		}
 	}
 
 	return nil, ErrNoNameservers
 }
 
-// recordTypes returns the record types a nameserver is asked for when a
-// name is checked.
-func recordTypes() []uint16 {
-	return []uint16{
-		dns.TypeA, dns.TypeAAAA, dns.TypeCNAME,
-		dns.TypeMX, dns.TypeTXT, dns.TypeSRV,
-		dns.TypeCAA, dns.TypeNS,
-	}
-}
-
-// addressTypes returns the record types ResolveIPAddresses asks for,
-// the only ones it reads.
-func addressTypes() []uint16 {
-	return []uint16{dns.TypeA, dns.TypeAAAA, dns.TypeCNAME}
-}
-
 // QueryNameserver queries a specific nameserver for all record
 // types and builds a NameserverResponse.
 func (r *Resolver) QueryNameserver(
 	ctx context.Context,
 	nsHostname string,
 	hostname string,
-) (*NameserverResponse, error) {
-	return r.queryNameserver(ctx, nsHostname, hostname, recordTypes())
-}
-
-// queryNameserver queries a specific nameserver for the record types
-// in qtypes and builds a NameserverResponse.
-func (r *Resolver) queryNameserver(
-	ctx context.Context,
-	nsHostname string,
-	hostname string,
-	qtypes []uint16,
 ) (*NameserverResponse, error) {
 	if checkCtx(ctx) != nil {
 		return nil, ErrContextCanceled
@@ -591,7 +551,7 @@ func (r *Resolver) queryNameserver(
 
 	hostname = dns.Fqdn(hostname)
 
-	return r.queryTypes(ctx, nsHostname, nsIPs[0], hostname, qtypes)
+	return r.queryAllTypes(ctx, nsHostname, nsIPs[0], hostname)
 }
 
 // QueryNameserverIP queries a nameserver by its IP address directly,
@@ -608,15 +568,14 @@ func (r *Resolver) QueryNameserverIP(
 
 	hostname = dns.Fqdn(hostname)
 
-	return r.queryTypes(ctx, nsHostname, nsIP, hostname, recordTypes())
+	return r.queryAllTypes(ctx, nsHostname, nsIP, hostname)
 }
 
-func (r *Resolver) queryTypes(
+func (r *Resolver) queryAllTypes(
 	ctx context.Context,
 	nsHostname string,
 	nsIP string,
 	hostname string,
-	qtypes []uint16,
 ) (*NameserverResponse, error) {
 	resp := &NameserverResponse{
 		Nameserver: nsHostname,
@@ -624,6 +583,12 @@ func (r *Resolver) queryTypes(
 		Status:     StatusOK,
 	}
 
+	qtypes := []uint16{
+		dns.TypeA, dns.TypeAAAA, dns.TypeCNAME,
+		dns.TypeMX, dns.TypeTXT, dns.TypeSRV,
+		dns.TypeCAA, dns.TypeNS,
+	}
+
 	state := r.queryEachType(ctx, nsIP, hostname, qtypes, resp)
 	classifyResponse(resp, state)
 
@@ -814,19 +779,18 @@ func (r *Resolver) QueryAllNameservers(
 		return nil, err
 	}
 
-	return r.queryEachNS(ctx, nameservers, hostname, recordTypes())
+	return r.queryEachNS(ctx, nameservers, hostname)
 }
 
 func (r *Resolver) queryEachNS(
 	ctx context.Context,
 	nameservers []string,
 	hostname string,
-	qtypes []uint16,
 ) (map[string]*NameserverResponse, error) {
 	results := make(map[string]*NameserverResponse)
 
 	for _, ns := range nameservers {
-		resp, err := r.queryNameserver(ctx, ns, hostname, qtypes)
+		resp, err := r.QueryNameserver(ctx, ns, hostname)
 
 		// A query the context cut short says nothing about the
 		// nameserver, so it must not be returned as its failure.
@@ -871,10 +835,9 @@ func (r *Resolver) LookupAllRecords(
 }
 
 // ResolveIPAddresses resolves a hostname to all IPv4 and IPv6
-// addresses, following CNAME chains up to MaxCNAMEDepth. It asks each
-// nameserver of the name's zone for its A, AAAA and CNAME records only.
-// When no nameserver of the name's zone answered, it returns an error
-// rather than no addresses.
+// addresses, following CNAME chains up to MaxCNAMEDepth. When no
+// nameserver of the name's zone answered, it returns an error rather
+// than no addresses.
 func (r *Resolver) ResolveIPAddresses(
 	ctx context.Context,
 	hostname string,
@@ -895,12 +858,7 @@ func (r *Resolver) resolveIPWithCNAME(
 		return nil, ErrCNAMEDepthExceeded
 	}
 
-	nameservers, err := r.FindAuthoritativeNameservers(ctx, hostname)
-	if err != nil {
-		return nil, err
-	}
-
-	results, err := r.queryEachNS(ctx, nameservers, hostname, addressTypes())
+	results, err := r.QueryAllNameservers(ctx, hostname)
 	if err != nil {
 		return nil, err
 	}

internal/resolver/resolver_test.go

@@ -11,7 +11,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -296,187 +295,6 @@ func TestQueryNameserver_Refused(t *testing.T) {
 	assert.Equal(t, "server returned REFUSED", resp.Error)
 }
 
-// TestQueryNameserverIP_RecursiveResolverRefused asks Quad9, a public
-// recursive resolver, about google.com at both of its addresses. Quad9
-// refuses a query that does not ask for recursion and answers one that
-// does. The resolver never asks for recursion, so it must be reported
-// as refusing, never as answering.
-func TestQueryNameserverIP_RecursiveResolverRefused(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-
-	for _, ip := range []string{"9.9.9.9", "149.112.112.112"} {
-		var resp *resolver.NameserverResponse
-
-		livednstest.Retry(
-			t,
-			"QueryNameserverIP("+ip+", google.com)",
-			func(ctx context.Context) error {
-				var err error
-
-				resp, err = r.QueryNameserverIP(
-					ctx, ip, ip, "google.com",
-				)
-				if err != nil {
-					return err
-				}
-
-				// A timeout or a network error is no reply at all.
-				if resp.Status == resolver.StatusTimeout ||
-					strings.HasPrefix(resp.Error, "network error") {
-					return fmt.Errorf(
-						"%w: %s: %s",
-						livednstest.ErrNoAnswer, ip, resp.Error,
-					)
-				}
-
-				return nil
-			},
-		)
-
-		assert.Equal(t, resolver.StatusError, resp.Status, ip)
-		assert.Equal(t, "server returned REFUSED", resp.Error, ip)
-	}
-}
-
-// googleNameserverIPv4s returns the IPv4 addresses of google.com's
-// nameservers, the only addresses the resolver asks servers at.
-func googleNameserverIPv4s(t *testing.T, r *resolver.Resolver) []string {
-	t.Helper()
-
-	names := liveFindAuthoritative(t, r, "google.com")
-
-	return liveResolveNSIPs(t, r, names, len(names))
-}
-
-// TestQueryServers_EveryServerRefused asks all of google.com's
-// nameservers about cloudflare.com, a zone they do not serve, which
-// they all refuse. The error says every server refused; it is not
-// ErrIntercepted, which only the root servers refusing shows.
-func TestQueryServers_EveryServerRefused(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-	servers := googleNameserverIPv4s(t, r)
-
-	var err error
-
-	livednstest.Retry(
-		t,
-		"QueryServers(google.com servers, cloudflare.com)",
-		func(ctx context.Context) error {
-			_, err = r.QueryServers(
-				ctx, servers, "google.com.", "cloudflare.com.",
-				dns.TypeNS,
-			)
-
-			// When not every server refused, one may have given no
-			// reply at all, so the attempt is tried again.
-			if err != nil &&
-				!strings.HasPrefix(err.Error(), "every server of") {
-				return fmt.Errorf(
-					"%w: %w", livednstest.ErrNoAnswer, err,
-				)
-			}
-
-			return nil
-		},
-	)
-
-	require.ErrorIs(t, err, resolver.ErrRefused)
-	require.NotErrorIs(t, err, resolver.ErrIntercepted)
-	require.EqualError(
-		t, err,
-		"every server of google.com. refused a query for "+
-			"cloudflare.com.: dns query refused",
-	)
-}
-
-// TestQueryServers_EveryRootServerRefused passes google.com's
-// nameservers to QueryServers as the servers of the root zone. They
-// refuse a query about cloudflare.com, as root servers would if
-// something on the network answered in their place, so the error is
-// ErrIntercepted.
-func TestQueryServers_EveryRootServerRefused(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-	servers := googleNameserverIPv4s(t, r)
-
-	var err error
-
-	livednstest.Retry(
-		t,
-		"QueryServers(google.com servers as root servers, cloudflare.com)",
-		func(ctx context.Context) error {
-			_, err = r.QueryServers(
-				ctx, servers, ".", "cloudflare.com.", dns.TypeNS,
-			)
-
-			// When not every server refused, one may have given no
-			// reply at all, so the attempt is tried again. Both errors
-			// for every server refusing say "refused a query for".
-			if err != nil &&
-				!strings.Contains(err.Error(), "refused a query for") {
-				return fmt.Errorf(
-					"%w: %w", livednstest.ErrNoAnswer, err,
-				)
-			}
-
-			return nil
-		},
-	)
-
-	require.ErrorIs(t, err, resolver.ErrIntercepted)
-	require.EqualError(
-		t, err,
-		"every root server refused a query for cloudflare.com.: "+
-			"this network intercepts DNS queries",
-	)
-}
-
-// TestQueryServers_NotEveryRootServerRefused passes google.com's
-// nameservers and 192.0.2.1 to QueryServers as the servers of the root
-// zone. The google.com nameservers refuse a query about cloudflare.com,
-// but nothing answers at 192.0.2.1, a documentation address, so not
-// every server refused, wherever 192.0.2.1 falls in the random order:
-// the error is not ErrIntercepted and does not say every server refused.
-func TestQueryServers_NotEveryRootServerRefused(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-	servers := googleNameserverIPv4s(t, r)
-	servers = append(servers, "192.0.2.1")
-
-	var err error
-
-	livednstest.Retry(
-		t,
-		"QueryServers(google.com servers and 192.0.2.1, cloudflare.com)",
-		func(ctx context.Context) error {
-			_, err = r.QueryServers(
-				ctx, servers, ".", "cloudflare.com.", dns.TypeNS,
-			)
-
-			// An attempt that ran out of time may not have asked every
-			// server, so it is tried again.
-			if ctx.Err() != nil {
-				return fmt.Errorf(
-					"%w: %w", livednstest.ErrNoAnswer, err,
-				)
-			}
-
-			return nil
-		},
-	)
-
-	require.Error(t, err)
-	require.NotErrorIs(t, err, resolver.ErrIntercepted)
-	// Both errors for every server refusing say "refused a query for".
-	require.NotContains(t, err.Error(), "refused a query for")
-}
-
 func TestQueryNameserver_RecordsSorted(t *testing.T) {
 	t.Parallel()
 
@@ -744,34 +562,6 @@ func TestResolveIPAddresses_CloudflareDomain(t *testing.T) {
 	assert.NotEmpty(t, ips)
 }
 
-// TestResolveIPAddresses_NameserverIPv4AndIPv6 looks up the addresses of
-// one of cloudflare.com's nameservers, as a domain check does for each
-// nameserver. That name has A and AAAA records, so both kinds of address
-// come back.
-func TestResolveIPAddresses_NameserverIPv4AndIPv6(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "cloudflare.com")
-	ips := liveResolveIPs(t, r, ns)
-
-	var ipv4, ipv6 int
-
-	for _, ip := range ips {
-		parsed := net.ParseIP(ip)
-		require.NotNil(t, parsed, "should be valid IP: %s", ip)
-
-		if parsed.To4() != nil {
-			ipv4++
-		} else {
-			ipv6++
-		}
-	}
-
-	assert.Positive(t, ipv4, "no IPv4 address for %s: %v", ns, ips)
-	assert.Positive(t, ipv6, "no IPv6 address for %s: %v", ns, ips)
-}
-
 // ----------------------------------------------------------------
 // Context cancellation tests
 // ----------------------------------------------------------------

internal/watcher/cname_test.go

@@ -12,11 +12,9 @@ import (
 	"sneak.berlin/go/dnswatcher/internal/watcher"
 )
 
-// Each name these tests look up in live DNS, and each zone a CNAME
-// points into, has two nameservers, to keep queries few (see the top
-// of watcher_test.go). cnameHost is a CNAME into another zone,
-// readthedocs.io: its nameservers answer with the CNAME and no address.
-const cnameHost = "flask.palletsprojects.com"
+// cnameHost is a CNAME into another zone: its nameservers answer with
+// the CNAME and no address.
+const cnameHost = "www.python.org"
 
 // TestCNAMEIntoAnotherZonePortAndTLSChecks checks cnameHost against
 // live DNS. Its port and TLS checks must use the addresses at the end
@@ -27,7 +25,7 @@ func TestCNAMEIntoAnotherZonePortAndTLSChecks(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{cnameHost}
 
-	_, deps := runChecks(t, cfg, nil)
+	deps := runChecks(t, cfg, nil, nil)
 
 	snap := deps.state.GetSnapshot()
 	hs := snap.Hostnames[cnameHost]
@@ -120,17 +118,16 @@ func followLive(
 // TestCNAMEAddressesOfEveryTarget gives a name's two nameservers
 // different CNAME targets, as when a secondary still serves an old one.
 // The addresses at the end of both are saved, whichever answer is read
-// first: one.one.one.one has 1.1.1.1, and dns.adguard-dns.com has
-// 94.140.14.14.
+// first: one.one.one.one has 1.1.1.1, and dns.google has 8.8.8.8.
 func TestCNAMEAddressesOfEveryTarget(t *testing.T) {
 	t.Parallel()
 
 	found := followLive(t, map[string]map[string][]string{
 		nsA: cnameTo("one.one.one.one."),
-		nsB: cnameTo("dns.adguard-dns.com."),
+		nsB: cnameTo("dns.google."),
 	})
 
-	for _, ip := range []string{"1.1.1.1", "94.140.14.14"} {
+	for _, ip := range []string{"1.1.1.1", "8.8.8.8"} {
 		if !slices.Contains(found, ip) {
 			t.Errorf("saved %v, want %s among them", found, ip)
 		}
@@ -144,7 +141,7 @@ func TestCNAMEChainEndingInNoAddressSavesEmptyList(t *testing.T) {
 	t.Parallel()
 
 	found := followLive(t, map[string]map[string][]string{
-		nsA: cnameTo("this-surely-does-not-exist-xyz.example.org."),
+		nsA: cnameTo("this-surely-does-not-exist-xyz.google.com."),
 	})
 
 	if found == nil || len(found) != 0 {

internal/watcher/watcher_test.go

@@ -26,22 +26,18 @@ import (
 
 // The watcher looks these names up in live DNS with the real resolver,
 // so tests assert on what the watcher does with the answers, never on
-// the records these zones publish. The nameservers of testHost and
-// testSmallDomain stay the same between a test looking them up and its
-// check. Every query a check sends is one more that can be lost, so the
-// tests keep them few. A check asks each of a name's nameservers about
-// every record type, and both names have two. A domain check also looks
-// up each nameserver's addresses at every nameserver of the zone that
-// nameserver is in: testSmallDomain's nameservers are in zones with two
-// nameservers, while a domain whose nameservers are in, say,
-// cloudflare.com, which has five, makes each domain check much longer.
-// A test checks a domain only when it is about domains, and checks once,
-// from saved state it builds, rather than twice. The tests that query
-// testDomain's nameservers directly do no domain check.
+// the records these zones publish. testHost's nameservers and addresses
+// stay the same from one check to the next, which the tests that check
+// it twice rely on, and testSmallDomain's nameservers stay the same
+// between a test looking them up and its check. A domain check looks up
+// each nameserver's addresses, about a second per nameserver, so the
+// tests that check a domain use testSmallDomain, which has two
+// nameservers, and check it once. The tests that query testDomain's
+// nameservers directly do no domain check.
 const (
 	testDomain      = "google.com"
-	testSmallDomain = "desec.io"
-	testHost        = "example.org"
+	testSmallDomain = "example.com"
+	testHost        = "cloudflare.com"
 	testIssuer      = "DigiCert"
 )
 
@@ -263,48 +259,55 @@ func checkOnce(
 
 // runChecks builds a watcher, lets prepare set up the saved state and
 // stand-ins it starts from, and runs its checks once against live DNS.
-// When the check finds no fresh address for a name (see checkOnce), the
-// watcher is thrown away and all of this runs again on a new one, so a
-// failed attempt leaves nothing behind in the saved state, the
-// stand-ins or the notifications.
+// If change is not nil, change then alters the saved state or stand-ins
+// and the checks run a second time. When either check finds no fresh
+// address for a name (see checkOnce), the watcher is thrown away and
+// all of this runs again on a new one, so a failed attempt leaves
+// nothing behind in the saved state, the stand-ins or the notifications.
 func runChecks(
 	t *testing.T,
 	cfg *config.Config,
-	prepare func(deps *testDeps),
-) (*watcher.Watcher, *testDeps) {
+	prepare, change func(deps *testDeps),
+) *testDeps {
 	t.Helper()
 
-	var (
-		w    *watcher.Watcher
-		deps *testDeps
-	)
+	var deps *testDeps
 
 	livednstest.Retry(t, "watcher checks", func(ctx context.Context) error {
+		var w *watcher.Watcher
+
 		w, deps = newTestWatcher(t, cfg)
 
 		if prepare != nil {
 			prepare(deps)
 		}
 
+		err := checkOnce(ctx, w, deps)
+		if err != nil || change == nil {
+			return err
+		}
+
+		change(deps)
+
 		return checkOnce(ctx, w, deps)
 	})
 
-	return w, deps
+	return deps
 }
 
-// lookupNameservers returns the nameservers live DNS lists for name,
+// lookupNameservers returns the nameservers live DNS lists for domain,
 // for a test to save in the state its check starts from.
-func lookupNameservers(t *testing.T, name string) []string {
+func lookupNameservers(t *testing.T, domain string) []string {
 	t.Helper()
 
 	res := resolver.NewFromLogger(slog.Default())
 
 	var nameservers []string
 
-	livednstest.Retry(t, "LookupNS("+name+")", func(ctx context.Context) error {
+	livednstest.Retry(t, "LookupNS("+domain+")", func(ctx context.Context) error {
 		var err error
 
-		nameservers, err = res.LookupNS(ctx, name)
+		nameservers, err = res.LookupNS(ctx, domain)
 
 		return err
 	})
@@ -368,7 +371,7 @@ func TestFirstRunBaseline(t *testing.T) {
 	cfg.Domains = []string{testSmallDomain}
 	cfg.Hostnames = []string{testHost}
 
-	_, deps := runChecks(t, cfg, nil)
+	deps := runChecks(t, cfg, nil, nil)
 
 	assertNoNotifications(t, deps)
 	assertStatePopulated(t, deps)
@@ -420,7 +423,7 @@ func TestDomainPortAndTLSChecks(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{testSmallDomain}
 
-	_, deps := runChecks(t, cfg, nil)
+	deps := runChecks(t, cfg, nil, nil)
 
 	snap := deps.state.GetSnapshot()
 
@@ -460,11 +463,11 @@ func TestNSChangeDetection(t *testing.T) {
 	cfg.Domains = []string{testSmallDomain}
 
 	// The saved state lists nameservers that live DNS does not.
-	_, deps := runChecks(t, cfg, func(deps *testDeps) {
+	deps := runChecks(t, cfg, func(deps *testDeps) {
 		deps.state.SetDomainState(testSmallDomain, &state.DomainState{
 			Nameservers: []string{oldNS1, oldNS2},
 		})
-	})
+	}, nil)
 
 	assertNotified(t, deps, "NS Change: "+testSmallDomain, "warning")
 
@@ -484,7 +487,7 @@ func TestNSAddressChangeDetection(t *testing.T) {
 
 	// The saved state lists the nameservers live DNS lists, each at an
 	// address live DNS never returns.
-	_, deps := runChecks(t, cfg, func(deps *testDeps) {
+	deps := runChecks(t, cfg, func(deps *testDeps) {
 		nsAddresses := make(map[string][]string, len(nameservers))
 		for _, ns := range nameservers {
 			nsAddresses[ns] = []string{oldIP}
@@ -494,7 +497,7 @@ func TestNSAddressChangeDetection(t *testing.T) {
 			Nameservers:         nameservers,
 			NameserverAddresses: nsAddresses,
 		})
-	})
+	}, nil)
 
 	title := "NS Address Change: " + testSmallDomain
 	ds, _ := deps.state.GetDomainState(testSmallDomain)
@@ -540,12 +543,12 @@ func TestNSAddedAndRemovedIsNoAddressChange(t *testing.T) {
 	// The saved state lists oldNS1, which live DNS does not, in place of
 	// the first nameserver live DNS lists, so that the check finds that
 	// one added and oldNS1 removed. Only oldNS1 has addresses saved.
-	_, deps := runChecks(t, cfg, func(deps *testDeps) {
+	deps := runChecks(t, cfg, func(deps *testDeps) {
 		deps.state.SetDomainState(testSmallDomain, &state.DomainState{
 			Nameservers:         append([]string{oldNS1}, nameservers[1:]...),
 			NameserverAddresses: map[string][]string{oldNS1: {oldIP}},
 		})
-	})
+	}, nil)
 
 	if n := countNotifications(deps, "NS Change: "+testSmallDomain); n != 1 {
 		t.Errorf("sent %d NS changes, want 1", n)
@@ -563,17 +566,15 @@ func TestRecordChangeDetection(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	nameservers := lookupNameservers(t, testHost)
-
-	// The saved state has every nameserver live DNS lists answering
-	// with an address live DNS never returns.
-	_, deps := runChecks(t, cfg, func(deps *testDeps) {
-		byNameserver := make(map[string]*state.NameserverRecordState)
-		for _, ns := range nameservers {
-			byNameserver[ns] = answered(map[string][]string{"A": {oldIP}})
+	// Between the checks, save for every nameserver an address live DNS
+	// never returns.
+	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
+		hs, _ := deps.state.GetHostnameState(testHost)
+		for _, nsState := range hs.RecordsByNameserver {
+			nsState.Records = map[string][]string{"A": {oldIP}}
 		}
 
-		deps.state.SetHostnameState(testHost, saved(byNameserver))
+		deps.state.SetHostnameState(testHost, hs)
 	})
 
 	assertNotified(t, deps, "Record Change: "+testHost, "warning")
@@ -585,15 +586,12 @@ func TestPortStateChange(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	w, deps := runChecks(t, cfg, nil)
-
-	// Every port closes, and the port checks run again. They look
-	// nothing up.
+	// Between the checks, every port closes.
+	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
 		deps.portChecker.mu.Lock()
 		deps.portChecker.closed = true
 		deps.portChecker.mu.Unlock()
-
-	w.CheckAllPorts(t.Context())
+	})
 
 	hs, _ := deps.state.GetHostnameState(testHost)
 	assertNotified(
@@ -613,7 +611,7 @@ func TestTLSExpiryWarning(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	_, deps := runChecks(t, cfg, expiresInThreeDays)
+	deps := runChecks(t, cfg, expiresInThreeDays, nil)
 
 	assertNotified(t, deps, "TLS Expiry Warning: "+testHost, "warning")
 }
@@ -785,7 +783,7 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 	cfg.Hostnames = []string{testHost}
 
 	// The saved state says the last check found testHost at oldIP.
-	_, deps := runChecks(t, cfg, func(deps *testDeps) {
+	deps := runChecks(t, cfg, func(deps *testDeps) {
 		deps.state.SetHostnameState(testHost, &state.HostnameState{
 			RecordsByNameserver: map[string]*state.NameserverRecordState{
 				oldNS1: {
@@ -794,7 +792,7 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 				},
 			},
 		})
-	})
+	}, nil)
 
 	snap := deps.state.GetSnapshot()
 
@@ -925,20 +923,21 @@ func TestNSFailureAndRecovery(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	nameservers := lookupNameservers(t, testHost)
-
-	// The saved state has every nameserver live DNS lists as one that
-	// did not answer, and, as answering, one that live DNS does not
-	// list, which then disappears.
-	_, deps := runChecks(t, cfg, func(deps *testDeps) {
-		byNameserver := map[string]*state.NameserverRecordState{
-			oldNS1: answered(map[string][]string{"A": {oldIP}}),
-		}
-		for _, ns := range nameservers {
-			byNameserver[ns] = failed()
+	// Between the checks, save every nameserver the first check found
+	// as one that did not answer, and add, as answering, one that live
+	// DNS does not list, which then disappears.
+	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
+		hs, _ := deps.state.GetHostnameState(testHost)
+		for ns := range hs.RecordsByNameserver {
+			hs.RecordsByNameserver[ns] = failed()
 		}
 
-		deps.state.SetHostnameState(testHost, saved(byNameserver))
+		hs.RecordsByNameserver[oldNS1] = &state.NameserverRecordState{
+			Records: map[string][]string{"A": {oldIP}},
+			Status:  "ok",
+		}
+
+		deps.state.SetHostnameState(testHost, hs)
 	})
 
 	assertNotified(t, deps, "NS Failure: "+testHost, "error")

script/docker

@@ -14,8 +14,8 @@ main() {
     cd "$ROOT"
     # Own line: a failing command substitution inside an argument does
     # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. The VERSION build arg takes precedence over what
-    # the build would derive from the .git in its context.
+    # empty constant. VERSION is computed here because .dockerignore
+    # excludes .git, so `git describe` in a build stage cannot find it.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
     docker build --no-cache-filter=lint,builder \