build: re-vendor canonical files from prompts dd4027b (closes #257)

The canonical files are fetched whole from sneak/prompts at dd4027b;
.golangci.yml keeps the livednstest deny entry and .dockerignore adds
/bin. Lint and test are phases of the Dockerfile (golangci-lint
v2.14.0; tests on the Debian Go 1.25.7 image with the same flags), and
the build stage depends on both and stamps the version the canonical
way. Dockerfile.lint is gone; the prettier stages of Dockerfile.fmt
moved into the Dockerfile, so Markdown formatting still runs in Docker.
Every scripted docker build passes --no-cache; script/cibuild
bootstraps, runs script/check, then builds the image. script/fmt-check
absorbs fmt-check-go and fmt-check-markdown. The canonical .gitignore
has no bin/ entry. The new linter raised no findings.

Model: opus-5-5

.editorconfig

@@ -10,6 +10,3 @@ insert_final_newline = true
 
 [Makefile]
 indent_style = tab
-
-[*.go]
-indent_style = tab

.gitea/workflows/check.yml

@@ -1,17 +1,9 @@
 name: check
 on: [push]
-# A new push to a branch cancels that branch's older run, queued or running;
-# runs on other branches, `next` and `main` among them, are left alone.
-concurrency:
-    group: ${{ github.workflow }}-${{ github.ref }}
-    cancel-in-progress: true
 jobs:
     check:
         runs-on: ubuntu-latest
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-              # script/cibuild needs no token, so none is left in .git/config.
-              with:
-                  persist-credentials: false
             - run: script/cibuild

.gitignore

@@ -45,13 +45,3 @@ node_modules/
 [iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
 [iI][dD]_[eE][dD]25519
 [iI][dD]_[eE][dD]25519_[sS][kK]
-
-# This repository's own entries, kept after the canonical content above.
-*.log
-*.out
-*.test
-bin/
-vendor/
-data/
-*.exe
-/dnswatcher

Dockerfile

@@ -18,10 +18,6 @@ RUN golangci-lint run --config .golangci.yml ./...
 # it ends, because the first run already failed.
 # golang 1.25.7-trixie, 2026-10-06
 FROM golang@sha256:2b174ffcf56c7ad0c47d30d2630693265639ddf2a5141149c2da34db921791b4 AS test
-# The file permission tests skip themselves as root, so the tests run as
-# an ordinary user, whose home directory holds Go's build cache.
-RUN useradd --create-home tester
-USER tester
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download

README.md

@@ -99,16 +99,10 @@ notification endpoint set, changes show only on the dashboard; see
   records, stored per nameserver. Their changes are notified as a hostname's
   are, as a record change, NS query failure, NS recovery, inconsistency or CNAME
   address change, in a message that starts `Domain:` where a hostname's starts
-  `Hostname:`. A nameserver removed from the domain's delegation gets only the
-  NS change notification above. A domain listed in
-  `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no record change or inconsistency
-  notification. A domain with no delegation of its own has these records asked
-  at the servers of the zone it is in, as a hostname has. A nameserver the
-  domain's records were asked at on the previous check but not on this one gets
-  a hostname's NS change notification (see below), unless it was in the domain's
-  delegation on the previous check, as when that delegation is withdrawn. A
-  domain that does not exist has none: they are not asked for, and those saved
-  by an earlier check are removed without a notification.
+  `Hostname:`. A domain with no delegation of its own has these records asked at
+  the servers of the zone it is in, as a hostname has. A domain that does not
+  exist has none: they are not asked for, and those saved by an earlier check
+  are removed without a notification.
 
 ### DNS Hostname Monitoring (Subdomains)
 
@@ -142,14 +136,10 @@ notification endpoint set, changes show only on the dashboard; see
   lower case, because names are case-insensitive and nameservers may answer in
   any letter case. TXT and CAA values keep their letter case; they are not
   lower-cased.
-- Any observable change in any nameserver's response triggers a notification,
-  except a record change or an inconsistency for a domain or hostname listed in
-  `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS`. This includes:
+- Any observable change in any nameserver's response triggers a notification.
+  This includes:
     - **Record change**: A nameserver returns different records than it did on
-      the previous check (additions, removals, value changes). For a domain or
-      hostname listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS`, neither a
-      record change nor an inconsistency is notified; its records are still
-      checked and saved, and its other notifications are sent.
+      the previous check (additions, removals, value changes).
     - **NS query failure**: A nameserver that previously responded becomes
       unreachable (timeout, SERVFAIL, REFUSED, network error). This is distinct
       from "responded with no records": a nameserver that answers NXDOMAIN or
@@ -161,10 +151,6 @@ notification endpoint set, changes show only on the dashboard; see
     - **NS recovery**: A previously-unreachable nameserver starts responding
       again. Its records are not compared with those from before it failed, so a
       change made while it was failing is not reported as a record change.
-    - **NS change**: A nameserver of the zone the hostname is in on the previous
-      check is not one now, whether or not it answered. One notification lists
-      every such nameserver on a `Removed:` line. Nothing is sent for a
-      nameserver that joins the zone.
     - **Inconsistency detected**: Two nameservers return different record sets
       for the same hostname and did not already differ on the previous check.
       Every pair of nameservers is compared. The alert is sent once for each
@@ -174,8 +160,7 @@ notification endpoint set, changes show only on the dashboard; see
       failed on it, and answers differently is reported on the check where it
       answers. So is a pair that differs in a record type whose query to either
       nameserver failed on the previous check. If a pair agrees again and later
-      disagrees, the alert is sent again. For a domain or hostname listed in
-      `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS`, no inconsistency is notified.
+      disagrees, the alert is sent again.
     - **CNAME address change**: The addresses at the end of a name's CNAME chain
       differ from those of the previous check. They are found when its
       nameservers answer with a CNAME and no address; a name that answers with
@@ -201,13 +186,9 @@ notification endpoint set, changes show only on the dashboard; see
 - Any change in port availability triggers a notification:
     - Port transitioned from open to closed (or vice versa).
     - New IP appeared (from DNS change): its port state is recorded without a
-      port notification; the DNS change notification shows the new address. A
-      domain or hostname listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets
-      no notification for an address added to its own A or AAAA records.
+      port notification; the DNS change notification shows the new address.
     - IP disappeared (from DNS change) — noted in the DNS change notification;
-      port state for that IP is removed. A domain or hostname listed in
-      `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no notification for an address
-      removed from its own A or AAAA records. When none of a name's nameservers
+      port state for that IP is removed. When none of a name's nameservers
       answered, its addresses are not known, so the port state saved for them is
       kept.
 
@@ -229,9 +210,7 @@ notification endpoint set, changes show only on the dashboard; see
 
 **Every observable state change produces a notification.** dnswatcher is
 designed as a real-time change feed — degradations, failures, recoveries, and
-routine changes are all reported equally. A domain or hostname listed in
-`DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no record change or inconsistency
-notification.
+routine changes are all reported equally.
 
 Supported notification backends:
 
@@ -246,9 +225,7 @@ includes:
 
 - **DNS record changes**: Which hostname or domain, which nameserver, what
   record type, old values, new values.
-- **DNS NS changes**: Which domain, which nameservers were added to or removed
-  from its delegation. For a hostname, or a domain with no delegation of its
-  own, which nameservers left the zone it is in.
+- **DNS NS changes**: Which domain, which nameservers were added/removed.
 - **NS address changes**: Which domain, which nameserver, its old and new
   addresses.
 - **CNAME address changes**: Which hostname or domain, the old and new addresses
@@ -432,24 +409,23 @@ following precedence (highest to lowest):
 
 ### Environment Variables
 
-| Variable                               | Description                                                                                                                           | Default               |
-| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
-| `PORT`                                 | HTTP listen port                                                                                                                      | `8080`                |
-| `DNSWATCHER_DEBUG`                     | Enable debug logging                                                                                                                  | `false`               |
-| `DNSWATCHER_DATA_DIR`                  | Directory for state file                                                                                                              | `/var/lib/dnswatcher` |
-| `DNSWATCHER_TARGETS`                   | Comma-separated DNS names (auto-classified via PSL)                                                                                   | `""`                  |
-| `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` | Comma-separated names from `DNSWATCHER_TARGETS` for which no record change or inconsistency is notified; any other name stops startup | `""`                  |
-| `DNSWATCHER_SLACK_WEBHOOK`             | Slack incoming webhook URL                                                                                                            | `""`                  |
-| `DNSWATCHER_MATTERMOST_WEBHOOK`        | Mattermost incoming webhook URL                                                                                                       | `""`                  |
-| `DNSWATCHER_NTFY_TOPIC`                | ntfy topic URL                                                                                                                        | `""`                  |
-| `DNSWATCHER_DNS_INTERVAL`              | DNS check interval, a positive duration such as `30m`; empty means the default, anything else stops startup                           | `1h`                  |
-| `DNSWATCHER_TLS_INTERVAL`              | TLS check interval, a positive duration such as `6h`; empty means the default, anything else stops startup                            | `12h`                 |
-| `DNSWATCHER_TLS_EXPIRY_WARNING`        | Days before expiry to warn                                                                                                            | `7`                   |
-| `DNSWATCHER_SENTRY_DSN`                | Sentry DSN for error reporting                                                                                                        | `""`                  |
-| `DNSWATCHER_MAINTENANCE_MODE`          | Only sets `maintenanceMode` in the health check response; changes nothing else                                                        | `false`               |
-| `DNSWATCHER_METRICS_USERNAME`          | Basic auth username for /metrics, which is served only when this is set                                                               | `""`                  |
-| `DNSWATCHER_METRICS_PASSWORD`          | Basic auth password for /metrics                                                                                                      | `""`                  |
-| `DNSWATCHER_SEND_TEST_NOTIFICATION`    | Send a test notification after first scan completes                                                                                   | `false`               |
+| Variable                            | Description                                                                                                 | Default               |
+| ----------------------------------- | ----------------------------------------------------------------------------------------------------------- | --------------------- |
+| `PORT`                              | HTTP listen port                                                                                            | `8080`                |
+| `DNSWATCHER_DEBUG`                  | Enable debug logging                                                                                        | `false`               |
+| `DNSWATCHER_DATA_DIR`               | Directory for state file                                                                                    | `/var/lib/dnswatcher` |
+| `DNSWATCHER_TARGETS`                | Comma-separated DNS names (auto-classified via PSL)                                                         | `""`                  |
+| `DNSWATCHER_SLACK_WEBHOOK`          | Slack incoming webhook URL                                                                                  | `""`                  |
+| `DNSWATCHER_MATTERMOST_WEBHOOK`     | Mattermost incoming webhook URL                                                                             | `""`                  |
+| `DNSWATCHER_NTFY_TOPIC`             | ntfy topic URL                                                                                              | `""`                  |
+| `DNSWATCHER_DNS_INTERVAL`           | DNS check interval, a positive duration such as `30m`; empty means the default, anything else stops startup | `1h`                  |
+| `DNSWATCHER_TLS_INTERVAL`           | TLS check interval, a positive duration such as `6h`; empty means the default, anything else stops startup  | `12h`                 |
+| `DNSWATCHER_TLS_EXPIRY_WARNING`     | Days before expiry to warn                                                                                  | `7`                   |
+| `DNSWATCHER_SENTRY_DSN`             | Sentry DSN for error reporting                                                                              | `""`                  |
+| `DNSWATCHER_MAINTENANCE_MODE`       | Only sets `maintenanceMode` in the health check response; changes nothing else                              | `false`               |
+| `DNSWATCHER_METRICS_USERNAME`       | Basic auth username for /metrics, which is served only when this is set                                     | `""`                  |
+| `DNSWATCHER_METRICS_PASSWORD`       | Basic auth password for /metrics                                                                            | `""`                  |
+| `DNSWATCHER_SEND_TEST_NOTIFICATION` | Send a test notification after first scan completes                                                         | `false`               |
 
 **`DNSWATCHER_TARGETS` is required.** dnswatcher will refuse to start if no
 monitoring targets are configured. A monitoring daemon with nothing to monitor
@@ -474,16 +450,6 @@ or empty variable (`DNSWATCHER_DNS_INTERVAL=`) means the default. If either is
 set to anything else, including a bare number or a zero or negative duration,
 dnswatcher refuses to start with an error naming the variable and the value.
 
-**`PORT` and `DNSWATCHER_TLS_EXPIRY_WARNING`** take a whole number: 1 to 65535
-for `PORT`, and a number of days, 1 or more, for
-`DNSWATCHER_TLS_EXPIRY_WARNING`. `DNSWATCHER_DEBUG`,
-`DNSWATCHER_MAINTENANCE_MODE` and `DNSWATCHER_SEND_TEST_NOTIFICATION` take
-`true` or `false`; `1`, `t`, `T`, `TRUE` and `True` also mean true, and `0`,
-`f`, `F`, `FALSE` and `False` also mean false. An unset or empty variable means
-the default. Any other value, such as `PORT=http`,
-`DNSWATCHER_TLS_EXPIRY_WARNING=7d` or `DNSWATCHER_DEBUG=yes`, makes dnswatcher
-refuse to start with an error naming the variable and the value.
-
 **`DNSWATCHER_SENTRY_DSN` reports crashes in HTTP requests to Sentry.** When it
 is set, a panic in an HTTP request handler is sent to Sentry, and the request
 still gets a `500 Internal Server Error` answer. Nothing else is sent to Sentry:
@@ -813,9 +779,7 @@ docker run -d \
       nameservers answered, the addresses an earlier check found at the end of
       the chain are used.
 4. **On change detection**: Send notifications to all configured endpoints,
-   update in-memory state, persist to disk. A record change or inconsistency for
-   a domain or hostname listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` sends
-   no notification, but the state is still updated and saved.
+   update in-memory state, persist to disk.
 5. **Shutdown**: The watcher stops checking and saves the final state to disk,
    and shutdown waits for that save before it goes on. Then it waits for
    in-flight notification deliveries to complete. Both waits share the fx

TODO.md

@@ -19,18 +19,9 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 # Completed Steps
 
-- 2026-10-13: a nameserver leaving a domain's delegation sends only NS Change;
-  one leaving a hostname's zone sends NS Change, not NS Failure (closes #262).
-- 2026-10-13: a bad `PORT`, `DNSWATCHER_TLS_EXPIRY_WARNING` or true/false
-  setting stops startup instead of being read as 0 or false (closes #269).
-- 2026-10-13: a check saving the state while the dashboard or `/api/v1/status`
-  is read cannot crash the process (closes #261).
 - 2026-10-06: canonical files re-fetched from `sneak/prompts` at `dd4027b`; lint
   and test are phases of the `Dockerfile`, every scripted build uncached (closes
   #257).
-- 2026-10-05: a name listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no
-  Record Change or Inconsistency notification; a name listed there that is not
-  in `DNSWATCHER_TARGETS` stops startup (closes #255).
 - 2026-10-02: a nameserver whose query for one record type failed while the
   others answered with no records is `ok`, not `nodata` (closes #253).
 - 2026-10-02: a domain that does not exist is shown so, with no nameservers; no

internal/config/config.go

@@ -5,8 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
-	"slices"
-	"strconv"
 	"strings"
 	"time"
 
@@ -25,9 +23,6 @@ const (
 	defaultTLSExpiryWarning = 7
 )
 
-// maxPort is the highest TCP port number.
-const maxPort = 65535
-
 // ErrNoTargets is returned when no monitoring targets are configured.
 var ErrNoTargets = errors.New(
 	"no monitoring targets configured: set DNSWATCHER_TARGETS environment variable",
@@ -40,27 +35,6 @@ var ErrInvalidInterval = errors.New(
 	"interval must be a positive duration such as 30m or 1h",
 )
 
-// ErrNotInTargets is returned when DNSWATCHER_SKIP_RECORD_NOTIFICATIONS
-// lists a name that is not in DNSWATCHER_TARGETS.
-var ErrNotInTargets = errors.New("name is not in DNSWATCHER_TARGETS")
-
-// ErrInvalidPort is returned when PORT is set but is not a whole number
-// from 1 to 65535. An empty value counts as unset and means the default.
-var ErrInvalidPort = errors.New("port must be a whole number from 1 to 65535")
-
-// ErrInvalidTLSExpiryWarning is returned when DNSWATCHER_TLS_EXPIRY_WARNING
-// is set but is not a whole number, 1 or more. An empty value counts as unset
-// and means the default.
-var ErrInvalidTLSExpiryWarning = errors.New(
-	"TLS expiry warning must be a whole number of days, 1 or more",
-)
-
-// ErrInvalidBool is returned when DNSWATCHER_DEBUG,
-// DNSWATCHER_MAINTENANCE_MODE or DNSWATCHER_SEND_TEST_NOTIFICATION is set
-// but is not a value strconv.ParseBool accepts. An empty value counts as
-// unset and means the default.
-var ErrInvalidBool = errors.New("value must be true or false")
-
 // Params contains dependencies for Config.
 type Params struct {
 	fx.In
@@ -71,25 +45,24 @@ type Params struct {
 
 // Config holds application configuration.
 type Config struct {
-	Port                    int
-	Debug                   bool
-	DataDir                 string
-	Domains                 []string
-	Hostnames               []string
-	SkipRecordNotifications []string
-	SlackWebhook            string
-	MattermostWebhook       string
-	NtfyTopic               string
-	DNSInterval             time.Duration
-	TLSInterval             time.Duration
-	TLSExpiryWarning        int
-	SentryDSN               string
-	MaintenanceMode         bool
-	MetricsUsername         string
-	MetricsPassword         string
-	SendTestNotification    bool
-	params                  *Params
-	log                     *slog.Logger
+	Port                 int
+	Debug                bool
+	DataDir              string
+	Domains              []string
+	Hostnames            []string
+	SlackWebhook         string
+	MattermostWebhook    string
+	NtfyTopic            string
+	DNSInterval          time.Duration
+	TLSInterval          time.Duration
+	TLSExpiryWarning     int
+	SentryDSN            string
+	MaintenanceMode      bool
+	MetricsUsername      string
+	MetricsPassword      string
+	SendTestNotification bool
+	params               *Params
+	log                  *slog.Logger
 }
 
 // New creates a new Config instance from environment and config files.
@@ -130,7 +103,6 @@ func setupViper(name string) {
 	viper.SetDefault("DEBUG", false)
 	viper.SetDefault("DATA_DIR", "/var/lib/"+name)
 	viper.SetDefault("TARGETS", "")
-	viper.SetDefault("SKIP_RECORD_NOTIFICATIONS", "")
 	viper.SetDefault("SLACK_WEBHOOK", "")
 	viper.SetDefault("MATTERMOST_WEBHOOK", "")
 	viper.SetDefault("NTFY_TOPIC", "")
@@ -148,9 +120,16 @@ func buildConfig(
 	log *slog.Logger,
 	params *Params,
 ) (*Config, error) {
-	err := readConfigFile(log)
+	err := viper.ReadInConfig()
 	if err != nil {
-		return nil, err
+		var notFound viper.ConfigFileNotFoundError
+		if !errors.As(err, &notFound) {
+			log.Error("config file malformed", "error", err)
+
+			return nil, fmt.Errorf(
+				"config file malformed: %w", err,
+			)
+		}
 	}
 
 	dnsInterval, err := parseInterval("DNS_INTERVAL")
@@ -168,78 +147,30 @@ func buildConfig(
 		return nil, err
 	}
 
-	skipRecordNotifications, err := parseSkipRecordNotifications(
-		domains, hostnames,
-	)
-	if err != nil {
-		return nil, err
-	}
-
-	port, err := parsePort()
-	if err != nil {
-		return nil, err
-	}
-
-	tlsExpiryWarning, err := parseTLSExpiryWarning()
-	if err != nil {
-		return nil, err
-	}
-
-	debug, err := parseBool("DEBUG")
-	if err != nil {
-		return nil, err
-	}
-
-	maintenanceMode, err := parseBool("MAINTENANCE_MODE")
-	if err != nil {
-		return nil, err
-	}
-
-	sendTestNotification, err := parseBool("SEND_TEST_NOTIFICATION")
-	if err != nil {
-		return nil, err
-	}
-
 	cfg := &Config{
-		Port:                    port,
-		Debug:                   debug,
-		DataDir:                 viper.GetString("DATA_DIR"),
-		Domains:                 domains,
-		Hostnames:               hostnames,
-		SkipRecordNotifications: skipRecordNotifications,
-		SlackWebhook:            viper.GetString("SLACK_WEBHOOK"),
-		MattermostWebhook:       viper.GetString("MATTERMOST_WEBHOOK"),
-		NtfyTopic:               viper.GetString("NTFY_TOPIC"),
-		DNSInterval:             dnsInterval,
-		TLSInterval:             tlsInterval,
-		TLSExpiryWarning:        tlsExpiryWarning,
-		SentryDSN:               viper.GetString("SENTRY_DSN"),
-		MaintenanceMode:         maintenanceMode,
-		MetricsUsername:         viper.GetString("METRICS_USERNAME"),
-		MetricsPassword:         viper.GetString("METRICS_PASSWORD"),
-		SendTestNotification:    sendTestNotification,
-		params:                  params,
-		log:                     log,
+		Port:                 viper.GetInt("PORT"),
+		Debug:                viper.GetBool("DEBUG"),
+		DataDir:              viper.GetString("DATA_DIR"),
+		Domains:              domains,
+		Hostnames:            hostnames,
+		SlackWebhook:         viper.GetString("SLACK_WEBHOOK"),
+		MattermostWebhook:    viper.GetString("MATTERMOST_WEBHOOK"),
+		NtfyTopic:            viper.GetString("NTFY_TOPIC"),
+		DNSInterval:          dnsInterval,
+		TLSInterval:          tlsInterval,
+		TLSExpiryWarning:     viper.GetInt("TLS_EXPIRY_WARNING"),
+		SentryDSN:            viper.GetString("SENTRY_DSN"),
+		MaintenanceMode:      viper.GetBool("MAINTENANCE_MODE"),
+		MetricsUsername:      viper.GetString("METRICS_USERNAME"),
+		MetricsPassword:      viper.GetString("METRICS_PASSWORD"),
+		SendTestNotification: viper.GetBool("SEND_TEST_NOTIFICATION"),
+		params:               params,
+		log:                  log,
 	}
 
 	return cfg, nil
 }
 
-// readConfigFile reads the config file, if there is one.
-func readConfigFile(log *slog.Logger) error {
-	err := viper.ReadInConfig()
-	if err != nil {
-		var notFound viper.ConfigFileNotFoundError
-		if !errors.As(err, &notFound) {
-			log.Error("config file malformed", "error", err)
-
-			return fmt.Errorf("config file malformed: %w", err)
-		}
-	}
-
-	return nil
-}
-
 // parseInterval reads the DNSWATCHER_-prefixed setting key as a duration. A
 // value that does not parse, or is zero or negative, is an error naming the
 // variable and the value; an unset variable has its default from setupViper.
@@ -256,53 +187,6 @@ func parseInterval(key string) (time.Duration, error) {
 	return interval, nil
 }
 
-// parsePort reads PORT, which has no DNSWATCHER_ prefix, as a port number. A
-// value that is not a whole number from 1 to 65535 is an error naming the
-// variable and the value; an unset variable has its default from setupViper.
-func parsePort() (int, error) {
-	value := viper.GetString("PORT")
-
-	port, err := strconv.Atoi(value)
-	if err != nil || port < 1 || port > maxPort {
-		return 0, fmt.Errorf("invalid PORT %q: %w", value, ErrInvalidPort)
-	}
-
-	return port, nil
-}
-
-// parseTLSExpiryWarning reads DNSWATCHER_TLS_EXPIRY_WARNING as a number of
-// days. A value that is not a whole number, 1 or more, is an error naming the
-// variable and the value; an unset variable has its default from setupViper.
-func parseTLSExpiryWarning() (int, error) {
-	value := viper.GetString("TLS_EXPIRY_WARNING")
-
-	days, err := strconv.Atoi(value)
-	if err != nil || days < 1 {
-		return 0, fmt.Errorf(
-			"invalid DNSWATCHER_TLS_EXPIRY_WARNING %q: %w",
-			value, ErrInvalidTLSExpiryWarning,
-		)
-	}
-
-	return days, nil
-}
-
-// parseBool reads the DNSWATCHER_-prefixed setting key as true or false. A
-// value strconv.ParseBool does not accept is an error naming the variable and
-// the value; an unset variable has its default from setupViper.
-func parseBool(key string) (bool, error) {
-	value := viper.GetString(key)
-
-	result, err := strconv.ParseBool(value)
-	if err != nil {
-		return false, fmt.Errorf(
-			"invalid DNSWATCHER_%s %q: %w", key, value, ErrInvalidBool,
-		)
-	}
-
-	return result, nil
-}
-
 func parseAndValidateTargets() ([]string, []string, error) {
 	domains, hostnames, err := ClassifyTargets(
 		parseCSV(viper.GetString("TARGETS")),
@@ -320,36 +204,6 @@ func parseAndValidateTargets() ([]string, []string, error) {
 	return domains, hostnames, nil
 }
 
-// parseSkipRecordNotifications reads DNSWATCHER_SKIP_RECORD_NOTIFICATIONS,
-// a comma-separated list of names from the targets. Each name is written
-// as ClassifyTargets writes a target, in lower case without a trailing
-// dot, and a name listed more than once is kept once. A name that is
-// not one of domains or hostnames is an error naming it.
-func parseSkipRecordNotifications(
-	domains, hostnames []string,
-) ([]string, error) {
-	value := viper.GetString("SKIP_RECORD_NOTIFICATIONS")
-
-	var names []string
-
-	for _, listed := range parseCSV(value) {
-		name := strings.ToLower(strings.TrimSuffix(listed, "."))
-
-		if !slices.Contains(domains, name) && !slices.Contains(hostnames, name) {
-			return nil, fmt.Errorf(
-				"invalid DNSWATCHER_SKIP_RECORD_NOTIFICATIONS %q: %w",
-				listed, ErrNotInTargets,
-			)
-		}
-
-		if !slices.Contains(names, name) {
-			names = append(names, name)
-		}
-	}
-
-	return names, nil
-}
-
 func parseCSV(input string) []string {
 	if input == "" {
 		return nil

internal/config/config_test.go

@@ -57,7 +57,6 @@ func TestNew_DefaultValues(t *testing.T) {
 	assert.Empty(t, cfg.MetricsUsername)
 	assert.Empty(t, cfg.MetricsPassword)
 	assert.False(t, cfg.SendTestNotification)
-	assert.Empty(t, cfg.SkipRecordNotifications)
 }
 
 func TestNew_EnvironmentOverrides(t *testing.T) {
@@ -116,7 +115,7 @@ func TestNew_OnlyEmptyCSVSegments(t *testing.T) {
 }
 
 // TestNew_InvalidIntervalStopsStartup checks values that must stop startup;
-// TestNew_DefaultValues and TestNew_EmptyValueMeansDefault check that an
+// TestNew_DefaultValues and TestNew_EmptyIntervalMeansDefault check that an
 // unset or empty interval means the default.
 func TestNew_InvalidIntervalStopsStartup(t *testing.T) {
 	variables := []string{"DNSWATCHER_DNS_INTERVAL", "DNSWATCHER_TLS_INTERVAL"}
@@ -144,107 +143,16 @@ func TestNew_InvalidIntervalStopsStartup(t *testing.T) {
 	}
 }
 
-func TestNew_EmptyValueMeansDefault(t *testing.T) {
+func TestNew_EmptyIntervalMeansDefault(t *testing.T) {
 	viper.Reset()
 	t.Setenv("DNSWATCHER_TARGETS", "example.com")
 	t.Setenv("DNSWATCHER_DNS_INTERVAL", "")
 	t.Setenv("DNSWATCHER_TLS_INTERVAL", "")
-	t.Setenv("PORT", "")
-	t.Setenv("DNSWATCHER_TLS_EXPIRY_WARNING", "")
-	t.Setenv("DNSWATCHER_DEBUG", "")
-	t.Setenv("DNSWATCHER_MAINTENANCE_MODE", "")
-	t.Setenv("DNSWATCHER_SEND_TEST_NOTIFICATION", "")
 
 	cfg, err := config.New(nil, newTestParams(t))
 	require.NoError(t, err)
 	assert.Equal(t, time.Hour, cfg.DNSInterval)
 	assert.Equal(t, 12*time.Hour, cfg.TLSInterval)
-	assert.Equal(t, 8080, cfg.Port)
-	assert.Equal(t, 7, cfg.TLSExpiryWarning)
-	assert.False(t, cfg.Debug)
-	assert.False(t, cfg.MaintenanceMode)
-	assert.False(t, cfg.SendTestNotification)
-}
-
-// TestNew_InvalidNumberOrBoolStopsStartup checks values that must stop
-// startup; TestNew_EnvironmentOverrides, the two tests after this one and
-// TestNew_EmptyValueMeansDefault check values that must not.
-func TestNew_InvalidNumberOrBoolStopsStartup(t *testing.T) {
-	notBools := []string{"yes", "on", "2", "tRUE"}
-	tests := []struct {
-		variable string
-		values   []string
-		want     error
-	}{
-		{
-			variable: "PORT",
-			values:   []string{"notaport", "0", "-1", "65536", "8080.5"},
-			want:     config.ErrInvalidPort,
-		},
-		{
-			variable: "DNSWATCHER_TLS_EXPIRY_WARNING",
-			values:   []string{"abc", "7d", "0", "-5"},
-			want:     config.ErrInvalidTLSExpiryWarning,
-		},
-		{
-			variable: "DNSWATCHER_DEBUG",
-			values:   notBools,
-			want:     config.ErrInvalidBool,
-		},
-		{
-			variable: "DNSWATCHER_MAINTENANCE_MODE",
-			values:   notBools,
-			want:     config.ErrInvalidBool,
-		},
-		{
-			variable: "DNSWATCHER_SEND_TEST_NOTIFICATION",
-			values:   notBools,
-			want:     config.ErrInvalidBool,
-		},
-	}
-
-	for _, tt := range tests {
-		for _, value := range tt.values {
-			t.Run(tt.variable+"="+value, func(t *testing.T) {
-				viper.Reset()
-				t.Setenv("DNSWATCHER_TARGETS", "example.com")
-				t.Setenv(tt.variable, value)
-
-				_, err := config.New(nil, newTestParams(t))
-				require.ErrorIs(t, err, tt.want)
-				require.ErrorContains(t, err, tt.variable)
-				require.ErrorContains(t, err, strconv.Quote(value))
-			})
-		}
-	}
-}
-
-func TestNew_LowestNumbersAndOtherSpellingsOfTrue(t *testing.T) {
-	viper.Reset()
-	t.Setenv("DNSWATCHER_TARGETS", "example.com")
-	t.Setenv("PORT", "1")
-	t.Setenv("DNSWATCHER_TLS_EXPIRY_WARNING", "1")
-	t.Setenv("DNSWATCHER_DEBUG", "1")
-	t.Setenv("DNSWATCHER_MAINTENANCE_MODE", "T")
-	t.Setenv("DNSWATCHER_SEND_TEST_NOTIFICATION", "True")
-
-	cfg, err := config.New(nil, newTestParams(t))
-	require.NoError(t, err)
-	assert.Equal(t, 1, cfg.Port)
-	assert.Equal(t, 1, cfg.TLSExpiryWarning)
-	assert.True(t, cfg.Debug)
-	assert.True(t, cfg.MaintenanceMode)
-	assert.True(t, cfg.SendTestNotification)
-}
-
-func TestNew_HighestPort(t *testing.T) {
-	viper.Reset()
-	t.Setenv("DNSWATCHER_TARGETS", "example.com")
-	t.Setenv("PORT", "65535")
-
-	cfg, err := config.New(nil, newTestParams(t))
-	require.NoError(t, err)
-	assert.Equal(t, 65535, cfg.Port)
 }
 
 func TestNew_DebugEnablesDebugLogging(t *testing.T) {
@@ -327,33 +235,6 @@ func TestNew_TargetsWithTrailingComma(t *testing.T) {
 		"trailing comma should be ignored")
 }
 
-func TestNew_SkipRecordNotifications(t *testing.T) {
-	viper.Reset()
-	t.Setenv("DNSWATCHER_TARGETS", "example.net,www.example.net,example.org")
-	t.Setenv("DNSWATCHER_SKIP_RECORD_NOTIFICATIONS",
-		" WWW.Example.net. , example.net,www.example.net")
-
-	cfg, err := config.New(nil, newTestParams(t))
-	require.NoError(t, err)
-	assert.Equal(t,
-		[]string{"www.example.net", "example.net"},
-		cfg.SkipRecordNotifications,
-		"names are written as targets are, each once",
-	)
-}
-
-func TestNew_SkipRecordNotificationsNotInTargetsStopsStartup(t *testing.T) {
-	viper.Reset()
-	t.Setenv("DNSWATCHER_TARGETS", "example.net")
-	t.Setenv("DNSWATCHER_SKIP_RECORD_NOTIFICATIONS",
-		"example.net,www.example.net")
-
-	_, err := config.New(nil, newTestParams(t))
-	require.ErrorIs(t, err, config.ErrNotInTargets)
-	require.ErrorContains(t, err, "DNSWATCHER_SKIP_RECORD_NOTIFICATIONS")
-	require.ErrorContains(t, err, `"www.example.net"`)
-}
-
 func TestNew_CustomDNSIntervalDuration(t *testing.T) {
 	viper.Reset()
 	t.Setenv("DNSWATCHER_TARGETS", "example.com")

internal/state/state.go

@@ -6,7 +6,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"log/slog"
-	"maps"
 	"os"
 	"path/filepath"
 	"slices"
@@ -271,21 +270,12 @@ func (s *State) Save() error {
 	return nil
 }
 
-// GetSnapshot returns a copy of the current snapshot, with copies of
-// its maps, so that a caller can range over them while the state is
-// written. The entries in the maps are not copied: an entry saved in the
-// state must be replaced, never changed in place.
+// GetSnapshot returns a copy of the current snapshot.
 func (s *State) GetSnapshot() Snapshot {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 
-	snap := *s.snapshot
-	snap.Domains = maps.Clone(snap.Domains)
-	snap.Hostnames = maps.Clone(snap.Hostnames)
-	snap.Ports = maps.Clone(snap.Ports)
-	snap.Certificates = maps.Clone(snap.Certificates)
-
-	return snap
+	return *s.snapshot
 }
 
 // SetDomainState updates the state for a domain.

internal/state/state_test.go

@@ -995,8 +995,7 @@ func TestPortStateUnmarshalJSON_BothFormats(t *testing.T) {
 	}
 }
 
-// TestGetSnapshot_ReturnsCopy verifies that the maps in the snapshot
-// GetSnapshot returns are not the state's own.
+// TestGetSnapshot_ReturnsCopy verifies that GetSnapshot returns a value copy.
 func TestGetSnapshot_ReturnsCopy(t *testing.T) {
 	t.Parallel()
 
@@ -1006,67 +1005,15 @@ func TestGetSnapshot_ReturnsCopy(t *testing.T) {
 
 	snap := s.GetSnapshot()
 
-	const added = "added.example.com"
-
-	snap.Domains[added] = &state.DomainState{}
-	snap.Hostnames[added] = &state.HostnameState{}
-	snap.Ports[added] = &state.PortState{}
-	snap.Certificates[added] = &state.CertificateState{}
-
-	if _, ok := s.GetDomainState(added); ok {
-		t.Error("the snapshot's Domains map is the state's own")
+	// Mutate the returned snapshot's map.
+	snap.Domains["mutated.example.com"] = &state.DomainState{
+		Nameservers: []string{"ns1.mutated.com."},
 	}
 
-	if _, ok := s.GetHostnameState(added); ok {
-		t.Error("the snapshot's Hostnames map is the state's own")
-	}
-
-	if _, ok := s.GetPortState(added); ok {
-		t.Error("the snapshot's Ports map is the state's own")
-	}
-
-	if _, ok := s.GetCertificateState(added); ok {
-		t.Error("the snapshot's Certificates map is the state's own")
-	}
-}
-
-// TestGetSnapshot_WhileWritten ranges over snapshots while another
-// goroutine writes the state, as the dashboard does while a check runs.
-// Under -race it fails when a snapshot's maps are the state's own.
-func TestGetSnapshot_WhileWritten(t *testing.T) {
-	t.Parallel()
-
-	s := state.NewForTestWithDataDir(t.TempDir())
-
-	const writes = 1000
-
-	written := make(chan struct{})
-
-	go func() {
-		defer close(written)
-
-		for range writes {
-			s.SetDomainState("example.com", &state.DomainState{})
-			s.SetHostnameState(testHostname, &state.HostnameState{})
-			s.SetPortState(testIPv4+":443", &state.PortState{})
-			s.SetCertificateState(
-				testIPv4+":443:"+testHostname, &state.CertificateState{},
-			)
-		}
-	}()
-
-	for {
-		select {
-		case <-written:
-			return
-		default:
-		}
-
-		// json.Marshal ranges over each of the snapshot's maps.
-		_, err := json.Marshal(s.GetSnapshot())
-		if err != nil {
-			t.Fatal(err)
-		}
+	// The original domain data should still be accessible.
+	_, ok := s.GetDomainState("example.com")
+	if !ok {
+		t.Error("original domain should still exist")
 	}
 }
 

internal/watcher/message_test.go

@@ -5,6 +5,7 @@ import (
 	"strings"
 	"testing"
 
+	"sneak.berlin/go/dnswatcher/internal/config"
 	"sneak.berlin/go/dnswatcher/internal/state"
 	"sneak.berlin/go/dnswatcher/internal/watcher"
 )
@@ -73,19 +74,21 @@ b.ns.example.net.: 192.0.2.2`,
 func TestDomainRecordNotificationsNameTheDomain(t *testing.T) {
 	t.Parallel()
 
-	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{domain}
-
-	deps := newTestDeps(t, cfg)
-	w := watcher.NewForTest(cfg, deps.state, nil, nil, nil, deps.notifier)
+	notifier := &mockNotifier{}
+	w := watcher.NewForTest(
+		&config.Config{Domains: []string{domain}},
+		nil, nil, nil, nil, notifier,
+	)
 
 	// nsA's address changes, which also makes it differ from nsC; nsB
-	// fails; nsC answers again.
+	// fails; nsC answers again; nsD is gone.
+	nsD := "d.ns.example.net."
 	w.DetectHostnameChanges(t.Context(), domain,
 		saved(map[string]*state.NameserverRecordState{
 			nsA: answered(map[string][]string{"A": {ip1}}),
 			nsB: answered(map[string][]string{"A": {ip1}}),
 			nsC: failed(),
+			nsD: answered(map[string][]string{"A": {ip1}}),
 		}),
 		saved(map[string]*state.NameserverRecordState{
 			nsA: answered(map[string][]string{"A": {ip2}}),
@@ -99,17 +102,18 @@ func TestDomainRecordNotificationsNameTheDomain(t *testing.T) {
 		t.Context(), domain, cnameState(ip1), cnameState(ip2),
 	)
 
+	// NS Failure is sent for nsB failing and for nsD being gone.
 	want := map[string]int{
 		"Record Change":        1,
 		"Inconsistency":        1,
-		"NS Failure":           1,
+		"NS Failure":           2,
 		"NS Recovery":          1,
 		"CNAME Address Change": 1,
 	}
 
 	sent := make(map[string]int)
 
-	for _, n := range deps.notifier.getNotifications() {
+	for _, n := range notifier.getNotifications() {
 		kind, _, _ := strings.Cut(n.Title, ":")
 		sent[kind]++
 
@@ -124,89 +128,6 @@ func TestDomainRecordNotificationsNameTheDomain(t *testing.T) {
 	}
 }
 
-// nsB, which answered, and nsC, which did not, are no longer among the
-// nameservers. One NS Change lists both, for the hostname and for the
-// configured apex domain with no delegation of its own. Nothing is sent
-// for the domain whose delegation on the previous check listed them:
-// the check of its delegation sends its NS Change.
-func TestRemovedNameserversAreAnNSChange(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name   string
-		target string
-		// The domain's nameservers saved by the previous check.
-		delegation []string
-		// The NS Change sent, or "" for none.
-		want string
-	}{
-		{
-			name:   "hostname",
-			target: host,
-			want: `Hostname: www.example.net
-Removed: b.ns.example.net., c.ns.example.net.`,
-		},
-		{
-			name:       "domain with no delegation of its own",
-			target:     domain,
-			delegation: []string{},
-			want: `Domain: example.net
-Removed: b.ns.example.net., c.ns.example.net.`,
-		},
-		{
-			name:       "domain whose delegation listed them",
-			target:     domain,
-			delegation: []string{nsA, nsB, nsC},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			cfg := defaultTestConfig(t)
-			cfg.Domains = []string{domain}
-
-			deps := newTestDeps(t, cfg)
-			w := watcher.NewForTest(
-				cfg, deps.state, nil, nil, nil, deps.notifier,
-			)
-
-			deps.state.SetDomainState(domain, &state.DomainState{
-				Nameservers: tt.delegation,
-			})
-
-			prev := saved(map[string]*state.NameserverRecordState{
-				nsA: answered(map[string][]string{"A": {ip1}}),
-				nsB: answered(map[string][]string{"A": {ip1}}),
-				nsC: failed(),
-			})
-			current := saved(map[string]*state.NameserverRecordState{
-				nsA: answered(map[string][]string{"A": {ip1}}),
-			})
-
-			w.DetectHostnameChanges(t.Context(), tt.target, prev, current)
-
-			got := deps.notifier.getNotifications()
-
-			if tt.want == "" {
-				if len(got) != 0 {
-					t.Errorf("sent %v, want nothing", got)
-				}
-
-				return
-			}
-
-			title := "NS Change: " + tt.target
-			if len(got) != 1 || got[0].Title != title ||
-				got[0].Message != tt.want {
-				t.Errorf("sent %v, want one %q with message:\n%s",
-					got, title, tt.want)
-			}
-		})
-	}
-}
-
 // The startup notification counts the configured domains and hostnames,
 // although the state's hostnames also hold the apex domain's own
 // records. Nothing is looked up: the watcher has no resolver.

internal/watcher/skiprecordnotifications_test.go

@@ -1,107 +0,0 @@
-package watcher_test
-
-import (
-	"slices"
-	"testing"
-
-	"sneak.berlin/go/dnswatcher/internal/config"
-	"sneak.berlin/go/dnswatcher/internal/state"
-	"sneak.berlin/go/dnswatcher/internal/watcher"
-)
-
-// TestSkipRecordNotificationsAlerts runs the hostname change detection
-// for two names on the same check: nsA's address changes, so that nsA
-// now differs from nsB, and nsC stops answering. The name in
-// SkipRecordNotifications gets only the NS Failure; the other name also
-// gets the Record Change and the Inconsistency.
-func TestSkipRecordNotificationsAlerts(t *testing.T) {
-	t.Parallel()
-
-	const skipped = "skipped.example.net"
-
-	prev := saved(map[string]*state.NameserverRecordState{
-		nsA: answered(map[string][]string{"A": {ip1}}),
-		nsB: answered(map[string][]string{"A": {ip1}}),
-		nsC: answered(map[string][]string{"A": {ip1}}),
-	})
-	current := saved(map[string]*state.NameserverRecordState{
-		nsA: answered(map[string][]string{"A": {ip2}}),
-		nsB: answered(map[string][]string{"A": {ip1}}),
-		nsC: failed(),
-	})
-
-	cfg := &config.Config{
-		Hostnames:               []string{host, skipped},
-		SkipRecordNotifications: []string{skipped},
-	}
-
-	// The hostname change detection uses only the configuration and the
-	// notifier.
-	notifier := &mockNotifier{}
-	w := watcher.NewForTest(cfg, nil, nil, nil, nil, notifier)
-
-	w.DetectHostnameChanges(t.Context(), host, prev, current)
-	w.DetectHostnameChanges(t.Context(), skipped, prev, current)
-
-	sent := notifier.getNotifications()
-	titles := make([]string, 0, len(sent))
-
-	for _, n := range sent {
-		titles = append(titles, n.Title)
-	}
-
-	slices.Sort(titles)
-
-	want := []string{
-		"Inconsistency: " + host,
-		"NS Failure: " + skipped,
-		"NS Failure: " + host,
-		"Record Change: " + host,
-	}
-
-	if !slices.Equal(titles, want) {
-		t.Errorf("sent %v, want %v", titles, want)
-	}
-}
-
-// TestSkipRecordNotificationsCheck checks testHost, which is in
-// SkipRecordNotifications, from a saved state in which every nameserver
-// live DNS lists answered with an address live DNS never returns. No
-// Record Change and no Inconsistency is sent, and the check still saves
-// what the nameservers answer.
-func TestSkipRecordNotificationsCheck(t *testing.T) {
-	t.Parallel()
-
-	cfg := defaultTestConfig(t)
-	cfg.Hostnames = []string{testHost}
-	cfg.SkipRecordNotifications = []string{testHost}
-
-	nameservers := lookupNameservers(t, testHost)
-
-	_, deps := runChecks(t, cfg, func(deps *testDeps) {
-		byNameserver := make(map[string]*state.NameserverRecordState)
-		for _, ns := range nameservers {
-			byNameserver[ns] = answered(map[string][]string{"A": {oldIP}})
-		}
-
-		deps.state.SetHostnameState(testHost, saved(byNameserver))
-	})
-
-	for _, title := range []string{
-		"Record Change: " + testHost,
-		"Inconsistency: " + testHost,
-	} {
-		if n := countNotifications(deps, title); n != 0 {
-			t.Errorf("sent %d %q, want 0", n, title)
-		}
-	}
-
-	// A nameserver whose query for A failed keeps oldIP, so the check
-	// is that some address live DNS gave was saved.
-	hs, _ := deps.state.GetHostnameState(testHost)
-	fromLiveDNS := func(ip string) bool { return ip != oldIP }
-
-	if !slices.ContainsFunc(addresses(hs), fromLiveDNS) {
-		t.Errorf("saved addresses %v, want those live DNS gave", addresses(hs))
-	}
-}

internal/watcher/watcher.go

@@ -327,25 +327,25 @@ func (w *Watcher) checkDomain(
 		w.detectNSAddressChanges(ctx, domain, prevAddresses, addresses)
 	}
 
-	// A domain that does not exist has no records of its own: none are
-	// asked for, and those saved by an earlier check are removed.
-	// Otherwise the apex domain's records are also checked and saved as
-	// a hostname's, so that the port and TLS checks find its addresses.
-	// Notifications about them name it as a domain (see nameLine). They
-	// are checked before the domain's new nameservers are saved:
-	// detectNSDisappearances reads those of the previous check.
-	if nxdomain {
-		w.state.DeleteHostnameState(domain)
-	} else {
-		w.checkHostname(ctx, domain)
-	}
-
 	w.state.SetDomainState(domain, &state.DomainState{
 		Nameservers:         nameservers,
 		NameserverAddresses: addresses,
 		NXDomain:            nxdomain,
 		LastChecked:         now,
 	})
+
+	// A domain that does not exist has no records of its own: none are
+	// asked for, and those saved by an earlier check are removed.
+	if nxdomain {
+		w.state.DeleteHostnameState(domain)
+
+		return
+	}
+
+	// The apex domain's records are also checked and saved as a
+	// hostname's, so that the port and TLS checks find its addresses.
+	// Notifications about them name it as a domain (see nameLine).
+	w.checkHostname(ctx, domain)
 }
 
 func (w *Watcher) detectNSChanges(
@@ -730,16 +730,12 @@ func (w *Watcher) detectCNAMEAddressChanges(
 // failed on either check has no records to compare. The records kept
 // for a record type whose query failed are compared too, but not those
 // of a type in UnknownTypes on either check, which the message leaves
-// out as well. Nothing is sent for a name in SkipRecordNotifications.
+// out as well.
 func (w *Watcher) detectRecordChanges(
 	ctx context.Context,
 	hostname string,
 	prev, current *state.HostnameState,
 ) {
-	if slices.Contains(w.config.SkipRecordNotifications, hostname) {
-		return
-	}
-
 	for ns, cur := range current.RecordsByNameserver {
 		prevNS, ok := prev.RecordsByNameserver[ns]
 		if !ok || prevNS.Status != statusOK || cur.Status != statusOK {
@@ -772,52 +768,28 @@ func (w *Watcher) detectRecordChanges(
 	}
 }
 
-// detectNSDisappearances sends one NS Change listing the nameservers of
-// the previous check that are no longer those of the zone hostname is
-// in. For a configured apex domain it leaves out those of the domain's
-// delegation on the previous check, which detectNSChanges notifies when
-// they are removed from it; checkDomain saves the new delegation only
-// after this runs.
 func (w *Watcher) detectNSDisappearances(
 	ctx context.Context,
 	hostname string,
 	prev, current *state.HostnameState,
 ) {
-	var delegation []string
-
-	if w.isDomain(hostname) {
-		if domainState, ok := w.state.GetDomainState(hostname); ok {
-			delegation = domainState.Nameservers
+	for ns, prevNS := range prev.RecordsByNameserver {
+		if _, ok := current.RecordsByNameserver[ns]; ok || prevNS.Status != statusOK {
+			continue
 		}
+
+		msg := fmt.Sprintf(
+			"%s\nNameserver: %s disappeared",
+			w.nameLine(hostname), ns,
+		)
+
+		w.notify.SendNotification(
+			ctx,
+			"NS Failure: "+hostname,
+			msg,
+			"error",
+		)
 	}
-
-	var removed []string
-
-	for ns := range prev.RecordsByNameserver {
-		_, ok := current.RecordsByNameserver[ns]
-		if !ok && !slices.Contains(delegation, ns) {
-			removed = append(removed, ns)
-		}
-	}
-
-	if len(removed) == 0 {
-		return
-	}
-
-	slices.Sort(removed)
-
-	msg := fmt.Sprintf(
-		"%s\nRemoved: %s",
-		w.nameLine(hostname),
-		strings.Join(removed, ", "),
-	)
-
-	w.notify.SendNotification(
-		ctx,
-		"NS Change: "+hostname,
-		msg,
-		"warning",
-	)
 }
 
 // detectNSFailures notifies when a nameserver that answered on the
@@ -863,18 +835,11 @@ func (w *Watcher) detectNSFailures(
 	}
 }
 
-// detectInconsistencies notifies each pair of nameservers that newly
-// disagree (see newlyDisagreeingPairs). Nothing is sent for a name in
-// SkipRecordNotifications.
 func (w *Watcher) detectInconsistencies(
 	ctx context.Context,
 	hostname string,
 	prev, current *state.HostnameState,
 ) {
-	if slices.Contains(w.config.SkipRecordNotifications, hostname) {
-		return
-	}
-
 	for _, pair := range newlyDisagreeingPairs(prev, current) {
 		ns1, ns2 := pair[0], pair[1]
 		state1 := current.RecordsByNameserver[ns1]

internal/watcher/watcher_test.go

@@ -558,9 +558,6 @@ func TestDomainThatDoesNotExist(t *testing.T) {
 // nameservers and without nxdomain, and its records, asked at the
 // codeberg.page servers, are saved. Those are testSmallDomain's two
 // nameservers; github.io, the zone of the README's example, has eight.
-// The previous check saved a delegation to oldNS1, now withdrawn, and
-// records asked at oldNS1: the NS Change of its delegation removes
-// oldNS1, and no other NS Change lists it again.
 func TestDomainWithNoDelegationOfItsOwn(t *testing.T) {
 	t.Parallel()
 
@@ -576,15 +573,6 @@ func TestDomainWithNoDelegationOfItsOwn(t *testing.T) {
 
 		w, deps = newTestWatcher(t, cfg)
 
-		deps.state.SetDomainState(domain, &state.DomainState{
-			Nameservers: []string{oldNS1},
-		})
-		deps.state.SetHostnameState(domain, saved(
-			map[string]*state.NameserverRecordState{
-				oldNS1: answered(map[string][]string{"A": {oldIP}}),
-			},
-		))
-
 		err := checkOnce(ctx, w, deps)
 
 		// A domain saved as not existing has no records to wait for;
@@ -605,22 +593,6 @@ func TestDomainWithNoDelegationOfItsOwn(t *testing.T) {
 	if _, ok := deps.state.GetHostnameState(domain); !ok {
 		t.Errorf("no records saved for %s", domain)
 	}
-
-	title := "NS Change: " + domain
-	want := "Domain: " + domain + "\nAdded: \nRemoved: " + oldNS1
-
-	var changes []notification
-
-	for _, n := range deps.notifier.getNotifications() {
-		if n.Title == title {
-			changes = append(changes, n)
-		}
-	}
-
-	if len(changes) != 1 || changes[0].Message != want {
-		t.Errorf("sent %v, want one %q with message:\n%s",
-			changes, title, want)
-	}
 }
 
 func TestNSAddressChangeDetection(t *testing.T) {
@@ -1077,7 +1049,7 @@ func TestSendTestNotification_Disabled(t *testing.T) {
 	}
 }
 
-func TestNSChangeAndRecovery(t *testing.T) {
+func TestNSFailureAndRecovery(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
@@ -1087,7 +1059,7 @@ func TestNSChangeAndRecovery(t *testing.T) {
 
 	// The saved state has every nameserver live DNS lists as one that
 	// did not answer, and, as answering, one that live DNS does not
-	// list, which the check then finds removed.
+	// list, which then disappears.
 	_, deps := runChecks(t, cfg, func(deps *testDeps) {
 		byNameserver := map[string]*state.NameserverRecordState{
 			oldNS1: answered(map[string][]string{"A": {oldIP}}),
@@ -1099,7 +1071,7 @@ func TestNSChangeAndRecovery(t *testing.T) {
 		deps.state.SetHostnameState(testHost, saved(byNameserver))
 	})
 
-	assertNotified(t, deps, "NS Change: "+testHost, "warning")
+	assertNotified(t, deps, "NS Failure: "+testHost, "error")
 	assertNotified(t, deps, "NS Recovery: "+testHost, "success")
 
 	// A nameserver that did not answer has no records to compare, so