fix: distinguish timeout from negative DNS responses (closes #35)

internal/resolver/errors.go

@@ -24,8 +24,4 @@ var (
 	// ErrContextCanceled wraps context cancellation for the
 	// resolver's iterative queries.
 	ErrContextCanceled = errors.New("context canceled")
-
-	// ErrSERVFAIL is returned when a DNS server responds with
-	// SERVFAIL after all retries are exhausted.
-	ErrSERVFAIL = errors.New("SERVFAIL from server")
 )

internal/resolver/iterative.go

@@ -435,6 +435,23 @@ func (r *Resolver) QueryNameserver(
 	return r.queryAllTypes(ctx, nsHostname, nsIPs[0], hostname)
 }
 
+// QueryNameserverIP queries a nameserver by its IP address directly,
+// bypassing NS hostname resolution.
+func (r *Resolver) QueryNameserverIP(
+	ctx context.Context,
+	nsHostname string,
+	nsIP string,
+	hostname string,
+) (*NameserverResponse, error) {
+	if checkCtx(ctx) != nil {
+		return nil, ErrContextCanceled
+	}
+
+	hostname = dns.Fqdn(hostname)
+
+	return r.queryAllTypes(ctx, nsHostname, nsIP, hostname)
+}
+
 func (r *Resolver) queryAllTypes(
 	ctx context.Context,
 	nsHostname string,
@@ -459,11 +476,6 @@ func (r *Resolver) queryAllTypes(
 	return resp, nil
 }
 
-const (
-	singleTypeMaxRetries     = 3
-	singleTypeInitialBackoff = 100 * time.Millisecond
-)
-
 type queryState struct {
 	gotNXDomain bool
 	gotSERVFAIL bool
@@ -495,21 +507,6 @@ func (r *Resolver) queryEachType(
 	return state
 }
 
-// isTimeout checks whether an error represents a DNS timeout.
-func isTimeout(err error) bool {
-	if err == nil {
-		return false
-	}
-
-	var netErr net.Error
-	if errors.As(err, &netErr) && netErr.Timeout() {
-		return true
-	}
-
-	// Also catch i/o timeout strings from the dns library.
-	return strings.Contains(err.Error(), "i/o timeout")
-}
-
 func (r *Resolver) querySingleType(
 	ctx context.Context,
 	nsIP string,
@@ -518,99 +515,25 @@ func (r *Resolver) querySingleType(
 	resp *NameserverResponse,
 	state *queryState,
 ) {
-	msg, lastErr := r.querySingleTypeWithRetry(
+	msg, err := r.queryDNS(ctx, nsIP, hostname, qtype)
-		ctx, nsIP, hostname, qtype,
+	if err != nil {
-	)
-	if msg == nil {
-		r.recordRetryFailure(lastErr, state)
-
-		return
-	}
-
-	r.handleDNSResponse(msg, resp, state)
-}
-
-func (r *Resolver) querySingleTypeWithRetry(
-	ctx context.Context,
-	nsIP string,
-	hostname string,
-	qtype uint16,
-) (*dns.Msg, error) {
-	var lastErr error
-
-	backoff := singleTypeInitialBackoff
-
-	for attempt := range singleTypeMaxRetries {
-		if checkCtx(ctx) != nil {
-			return nil, ErrContextCanceled
-		}
-
-		if attempt > 0 {
-			if !waitBackoff(ctx, backoff) {
-				return nil, ErrContextCanceled
-			}
-
-			backoff *= timeoutMultiplier
-		}
-
-		msg, err := r.queryDNS(ctx, nsIP, hostname, qtype)
-		if err != nil {
-			lastErr = err
-
-			if !isTimeout(err) {
-				return nil, err
-			}
-
-			continue
-		}
-
-		if msg.Rcode == dns.RcodeServerFailure {
-			lastErr = ErrSERVFAIL
-
-			continue
-		}
-
-		return msg, nil
-	}
-
-	return nil, lastErr
-}
-
-func waitBackoff(ctx context.Context, d time.Duration) bool {
-	select {
-	case <-ctx.Done():
-		return false
-	case <-time.After(d):
-		return true
-	}
-}
-
-func (r *Resolver) recordRetryFailure(
-	lastErr error,
-	state *queryState,
-) {
-	if lastErr == nil {
-		return
-	}
-
-	if isTimeout(lastErr) {
 		state.gotTimeout = true
-	} else if errors.Is(lastErr, ErrSERVFAIL) {
-		state.gotSERVFAIL = true
-	}
-}
 
-func (r *Resolver) handleDNSResponse(
+		return
-	msg *dns.Msg,
+	}
-	resp *NameserverResponse,
+
-	state *queryState,
-) {
 	if msg.Rcode == dns.RcodeNameError {
 		state.gotNXDomain = true
 
 		return
 	}
 
+	if msg.Rcode == dns.RcodeServerFailure {
+		state.gotSERVFAIL = true
+
+		return
+	}
+
 	collectAnswerRecords(msg, resp, state)
 }
 
@@ -639,10 +562,10 @@ func classifyResponse(resp *NameserverResponse, state queryState) {
 		resp.Status = StatusNXDomain
 	case state.gotTimeout && !state.hasRecords:
 		resp.Status = StatusTimeout
-		resp.Error = "all queries timed out after retries"
+		resp.Error = "all queries timed out"
 	case state.gotSERVFAIL && !state.hasRecords:
 		resp.Status = StatusError
-		resp.Error = "server failure (SERVFAIL) after retries"
+		resp.Error = "server returned SERVFAIL"
 	case !state.hasRecords && !state.gotNXDomain:
 		resp.Status = StatusNoData
 	}

internal/resolver/resolver_test.go

@@ -10,6 +10,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -622,6 +623,59 @@ func TestQueryAllNameservers_ContextCanceled(t *testing.T) {
 	assert.Error(t, err)
 }
 
+// ----------------------------------------------------------------
+// Timeout tests
+// ----------------------------------------------------------------
+
+func TestQueryNameserverIP_Timeout(t *testing.T) {
+	t.Parallel()
+
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelDebug},
+	))
+
+	r := resolver.NewFromLoggerWithClient(
+		log, &timeoutClient{},
+	)
+
+	ctx, cancel := context.WithTimeout(
+		context.Background(), 10*time.Second,
+	)
+	t.Cleanup(cancel)
+
+	// Query any IP — the client always returns a timeout error.
+	resp, err := r.QueryNameserverIP(
+		ctx, "unreachable.test.", "192.0.2.1",
+		"example.com",
+	)
+	require.NoError(t, err)
+
+	assert.Equal(t, resolver.StatusTimeout, resp.Status)
+	assert.NotEmpty(t, resp.Error)
+}
+
+// timeoutClient simulates DNS timeout errors for testing.
+type timeoutClient struct{}
+
+func (c *timeoutClient) ExchangeContext(
+	_ context.Context,
+	_ *dns.Msg,
+	_ string,
+) (*dns.Msg, time.Duration, error) {
+	return nil, 0, &net.OpError{
+		Op:  "read",
+		Net: "udp",
+		Err: &timeoutError{},
+	}
+}
+
+type timeoutError struct{}
+
+func (e *timeoutError) Error() string   { return "i/o timeout" }
+func (e *timeoutError) Timeout() bool   { return true }
+func (e *timeoutError) Temporary() bool { return true }
+
 func TestResolveIPAddresses_ContextCanceled(t *testing.T) {
 	t.Parallel()