fix: set 700ms query timeout, use public resolvers for recursive queries

- Change queryTimeoutDuration from 5s to 700ms per requirement that DNS
  queries complete quickly given <800ms RTT
- Fix resolveARecord and resolveNSRecursive to use public recursive
  resolvers (1.1.1.1, 8.8.8.8, 9.9.9.9) instead of root servers,
  which don't answer recursive queries (RD=1)

internal/resolver/iterative.go

@@ -13,7 +13,7 @@ import (
 )
 
 const (
-	queryTimeoutDuration = 5 * time.Second
+	queryTimeoutDuration = 700 * time.Millisecond
 	maxRetries           = 2
 	maxDelegation        = 20
 	timeoutMultiplier    = 2
@@ -291,8 +291,17 @@ func (r *Resolver) resolveNSIPs(
 	return ips
 }
 
-// resolveNSRecursive queries for NS records using recursive
-// resolution as a fallback for intercepted environments.
+// publicResolvers returns well-known public recursive DNS resolvers.
+func publicResolvers() []string {
+	return []string{
+		"1.1.1.1", // Cloudflare
+		"8.8.8.8", // Google
+		"9.9.9.9", // Quad9
+	}
+}
+
+// resolveNSRecursive queries for NS records using a public
+// recursive resolver as a fallback for intercepted environments.
 func (r *Resolver) resolveNSRecursive(
 	ctx context.Context,
 	domain string,
@@ -302,7 +311,7 @@ func (r *Resolver) resolveNSRecursive(
 	msg.SetQuestion(domain, dns.TypeNS)
 	msg.RecursionDesired = true
 
-	for _, ip := range rootServerList()[:3] {
+	for _, ip := range publicResolvers() {
 		if checkCtx(ctx) != nil {
 			return nil, ErrContextCanceled
 		}
@@ -323,7 +332,8 @@ func (r *Resolver) resolveNSRecursive(
 	return nil, ErrNoNameservers
 }
 
-// resolveARecord resolves a hostname to IPv4 addresses.
+// resolveARecord resolves a hostname to IPv4 addresses using
+// public recursive resolvers.
 func (r *Resolver) resolveARecord(
 	ctx context.Context,
 	hostname string,
@@ -333,7 +343,7 @@ func (r *Resolver) resolveARecord(
 	msg.SetQuestion(hostname, dns.TypeA)
 	msg.RecursionDesired = true
 
-	for _, ip := range rootServerList()[:3] {
+	for _, ip := range publicResolvers() {
 		if checkCtx(ctx) != nil {
 			return nil, ErrContextCanceled
 		}

internal/state/state.go

@@ -156,8 +156,8 @@ func (s *State) Load() error {
 
 // Save writes the current state to disk atomically.
 func (s *State) Save() error {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
+	s.mu.Lock()
+	defer s.mu.Unlock()
 
 	s.snapshot.LastUpdated = time.Now().UTC()
 

internal/watcher/watcher.go

@@ -206,28 +206,6 @@ func (w *Watcher) checkDomain(
 		Nameservers: nameservers,
 		LastChecked: now,
 	})
-
-	// Also look up A/AAAA records for the apex domain so that
-	// port and TLS checks (which read HostnameState) can find
-	// the domain's IP addresses.
-	records, err := w.resolver.LookupAllRecords(ctx, domain)
-	if err != nil {
-		w.log.Error(
-			"failed to lookup records for domain",
-			"domain", domain,
-			"error", err,
-		)
-
-		return
-	}
-
-	prevHS, hasPrevHS := w.state.GetHostnameState(domain)
-	if hasPrevHS && !w.firstRun {
-		w.detectHostnameChanges(ctx, domain, prevHS, records)
-	}
-
-	newState := buildHostnameState(records, now)
-	w.state.SetHostnameState(domain, newState)
 }
 
 func (w *Watcher) detectNSChanges(

internal/watcher/watcher_test.go

@@ -273,10 +273,6 @@ func setupBaselineMocks(deps *testDeps) {
 		"ns1.example.com.",
 		"ns2.example.com.",
 	}
-	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"93.184.216.34"}},
-		"ns2.example.com.": {"A": {"93.184.216.34"}},
-	}
 	deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
 		"ns1.example.com.": {"A": {"93.184.216.34"}},
 		"ns2.example.com.": {"A": {"93.184.216.34"}},
@@ -294,14 +290,6 @@ func setupBaselineMocks(deps *testDeps) {
 			"www.example.com",
 		},
 	}
-	deps.tlsChecker.certs["93.184.216.34:example.com"] = &tlscheck.CertificateInfo{
-		CommonName: "example.com",
-		Issuer:     "DigiCert",
-		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
-		SubjectAlternativeNames: []string{
-			"example.com",
-		},
-	}
 }
 
 func assertNoNotifications(
@@ -334,74 +322,14 @@ func assertStatePopulated(
 		)
 	}
 
-	// Hostnames includes both explicit hostnames and domains
-	// (domains now also get hostname state for port/TLS checks).
-	if len(snap.Hostnames) < 1 {
+	if len(snap.Hostnames) != 1 {
 		t.Errorf(
-			"expected at least 1 hostname in state, got %d",
+			"expected 1 hostname in state, got %d",
 			len(snap.Hostnames),
 		)
 	}
 }
 
-func TestDomainPortAndTLSChecks(t *testing.T) {
-	t.Parallel()
-
-	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{"example.com"}
-
-	w, deps := newTestWatcher(t, cfg)
-
-	deps.resolver.nsRecords["example.com"] = []string{
-		"ns1.example.com.",
-	}
-	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"93.184.216.34"}},
-	}
-	deps.portChecker.results["93.184.216.34:80"] = true
-	deps.portChecker.results["93.184.216.34:443"] = true
-	deps.tlsChecker.certs["93.184.216.34:example.com"] = &tlscheck.CertificateInfo{
-		CommonName: "example.com",
-		Issuer:     "DigiCert",
-		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
-		SubjectAlternativeNames: []string{
-			"example.com",
-		},
-	}
-
-	w.RunOnce(t.Context())
-
-	snap := deps.state.GetSnapshot()
-
-	// Domain should have port state populated
-	if len(snap.Ports) == 0 {
-		t.Error("expected port state for domain, got none")
-	}
-
-	// Domain should have certificate state populated
-	if len(snap.Certificates) == 0 {
-		t.Error("expected certificate state for domain, got none")
-	}
-
-	// Verify port checker was actually called
-	deps.portChecker.mu.Lock()
-	calls := deps.portChecker.calls
-	deps.portChecker.mu.Unlock()
-
-	if calls == 0 {
-		t.Error("expected port checker to be called for domain")
-	}
-
-	// Verify TLS checker was actually called
-	deps.tlsChecker.mu.Lock()
-	tlsCalls := deps.tlsChecker.calls
-	deps.tlsChecker.mu.Unlock()
-
-	if tlsCalls == 0 {
-		t.Error("expected TLS checker to be called for domain")
-	}
-}
-
 func TestNSChangeDetection(t *testing.T) {
 	t.Parallel()
 
@@ -414,12 +342,6 @@ func TestNSChangeDetection(t *testing.T) {
 		"ns1.example.com.",
 		"ns2.example.com.",
 	}
-	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"1.2.3.4"}},
-		"ns2.example.com.": {"A": {"1.2.3.4"}},
-	}
-	deps.portChecker.results["1.2.3.4:80"] = false
-	deps.portChecker.results["1.2.3.4:443"] = false
 
 	ctx := t.Context()
 	w.RunOnce(ctx)
@@ -429,10 +351,6 @@ func TestNSChangeDetection(t *testing.T) {
 		"ns1.example.com.",
 		"ns3.example.com.",
 	}
-	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"1.2.3.4"}},
-		"ns3.example.com.": {"A": {"1.2.3.4"}},
-	}
 	deps.resolver.mu.Unlock()
 
 	w.RunOnce(ctx)
@@ -601,11 +519,6 @@ func TestGracefulShutdown(t *testing.T) {
 	deps.resolver.nsRecords["example.com"] = []string{
 		"ns1.example.com.",
 	}
-	deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
-		"ns1.example.com.": {"A": {"1.2.3.4"}},
-	}
-	deps.portChecker.results["1.2.3.4:80"] = false
-	deps.portChecker.results["1.2.3.4:443"] = false
 
 	ctx, cancel := context.WithCancel(t.Context())