resolver: a query cut short by the caller's context records no reason (closes #298)

When the caller's context ends, the next query returns
ErrContextCanceled before anything is sent. querySingleType recorded
that as a network error, which outranks a timeout, so a nameserver that
had only timed out could be reported as "network error: context
canceled". It now records no reason for it.

A try the context's deadline cuts short ends as a timeout. When the
context has ended before a further try, tryExchange now returns that
try's error instead of ErrContextCanceled, so such a nameserver is
reported as timed out, not as answering.

Model: opus-5-5

README.md

@@ -561,18 +561,6 @@ This approach ensures:
 - Ability to detect split-horizon or inconsistent responses across authoritative
   servers.
 
-A root server never offers recursion, so a reply marked "recursion available"
-from a root server's address came from a recursive resolver on the network
-answering in its place, as on a network where a router rule, a VPN or a DNS
-filter sends all DNS to one resolver. The first such reply from a root server's
-address, a refusal included, stops the lookup at once with the error "this
-network intercepts DNS queries", naming that address, and no other root server
-is asked. A lookup that every root server refuses without that mark fails with
-the same error. Every lookup starts at the root servers, so on such a network
-every lookup fails with that error, whether or not that resolver has the name
-cached, and dnswatcher's tests fail there too. That is by design: nothing asks
-again another way or otherwise works around the interception.
-
 A watched name's records are stored as its nameservers return them, CNAME
 included. When they return a CNAME and no address, the chain of every CNAME
 target they gave is followed (with a depth limit to prevent loops) to the A and

TODO.md

@@ -19,10 +19,6 @@ milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
 
 # Completed Steps
 
-- 2026-10-16: the first reply marked "recursion available" from a root server's
-  address, a refusal included, stops the lookup with "this network intercepts
-  DNS queries", so on a network that sends DNS to a resolver dnswatcher and its
-  tests fail, by design (closes #300).
 - 2026-10-15: a query its caller's context ends before it is sent records no
   reason about the nameserver, and a try the context's deadline cuts short is a
   timeout, so a nameserver whose only failures were timeouts is `timeout`, not a

internal/resolver/errors.go

@@ -53,13 +53,9 @@ var (
 		"reply truncated and its retry over TCP failed",
 	)
 
-	// ErrIntercepted is returned when a root server's address gave a
+	// ErrIntercepted is returned when every root server refused a
-	// reply marked recursion available, a refusal included, which ends
+	// query. Root servers refuse no query, so the refusals came from
-	// the lookup at once, or when every root server refused a query.
+	// something on the network answering in their place.
-	// Root servers do neither, so those replies came from something on
-	// the network answering in their place. On such a network
-	// dnswatcher fails with it, by design: nothing works around the
-	// interception.
 	ErrIntercepted = errors.New("this network intercepts DNS queries")
 
 	// ErrCNAMEDepthExceeded is returned when a CNAME chain

internal/resolver/iterative.go

@@ -115,8 +115,7 @@ func (r *Resolver) retryTCP(
 }
 
 // queryDNS sends a DNS query to a specific server IP, never asking it
-// for recursion. A reply of REFUSED is returned together with
+// for recursion. A reply of REFUSED is returned as ErrRefused.
-// ErrRefused, so that the caller can still read the reply's flags.
 func (r *Resolver) queryDNS(
 	ctx context.Context,
 	serverIP string,
@@ -140,7 +139,7 @@ func (r *Resolver) queryDNS(
 	}
 
 	if resp.Rcode == dns.RcodeRefused {
-		return resp, fmt.Errorf(
+		return nil, fmt.Errorf(
 			"query %s @%s: %w", name, serverIP, ErrRefused,
 		)
 	}
@@ -285,15 +284,10 @@ func shuffled(
 }
 
 // queryServers asks servers, the servers of zone, about name in a random
-// order until one gives a usable reply. When they are the root servers,
+// order until one gives a usable reply. A server that times out, refuses
-// the first reply marked recursion available, a refusal included, ends
+// or gives a reply that is not usable is passed over for the next. When
-// the lookup with ErrIntercepted, naming the address it came from, and
+// every server refused, the error says so, and when they are the root
-// no other root server is asked: root servers offer no recursion, so
+// servers it is ErrIntercepted.
-// that reply came from something on the network answering in their
-// place. Otherwise a server that times out, refuses or gives a reply
-// that is not usable is passed over for the next. When every server
-// refused, the error says so, and when they are the root servers it is
-// ErrIntercepted.
 func (r *Resolver) queryServers(
 	ctx context.Context,
 	servers []string,
@@ -310,17 +304,7 @@ func (r *Resolver) queryServers(
 			return nil, ErrContextCanceled
 		}
 
-		// queryDNS returns a refusal together with its reply, so a
-		// refusal's mark is checked here too.
 		resp, err := r.queryDNS(ctx, ip, name, qtype)
-		if resp != nil && zone == "." && resp.RecursionAvailable {
-			return nil, fmt.Errorf(
-				"query %s @%s: reply marked recursion available, "+
-					"so not from a root server: %w",
-				name, ip, ErrIntercepted,
-			)
-		}
-
 		if err == nil && !usableReply(resp, zone, name) {
 			err = fmt.Errorf(
 				"query %s @%s: %w", name, ip, ErrUnusableReply,

internal/resolver/resolver_test.go

@@ -850,74 +850,6 @@ func TestQueryServers_NotEveryRootServerRefused(t *testing.T) {
 	require.NotContains(t, err.Error(), "refused a query for")
 }
 
-// TestQueryServers_RecursiveResolversAsRootServers passes public
-// recursive resolvers to QueryServers as the servers of the root zone,
-// as a network that sends every DNS query to a resolver would. Their
-// replies are marked recursion available, which no root server's is:
-// SERVFAIL, REFUSED, or an answer from a resolver's cache, as 1.1.1.1
-// gives for com., which would be used if a root server gave it. The
-// first such reply ends the lookup with ErrIntercepted, naming the
-// resolver that gave it. In the first group the replies differ; every
-// resolver in the second refuses a query that does not ask for
-// recursion, as 9.9.9.9 does, so there a refusal ends the lookup
-// instead of being passed over. Each group has resolvers of four
-// operators, and a resolver that gives no reply is passed over for the
-// next, so one of them answering is enough.
-func TestQueryServers_RecursiveResolversAsRootServers(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-	groups := [][]string{
-		{"1.1.1.1", "8.8.8.8", "9.9.9.9", "208.67.222.222"},
-		{"64.6.64.6", "185.222.222.222", "4.2.2.1", "94.140.14.14"},
-	}
-
-	for _, resolvers := range groups {
-		for _, name := range []string{"com.", "desec.io."} {
-			var err error
-
-			livednstest.Retry(
-				t,
-				"QueryServers("+strings.Join(resolvers, ", ")+
-					" as root servers, "+name+")",
-				func(ctx context.Context) error {
-					_, err = r.QueryServers(
-						ctx, resolvers, ".", name, dns.TypeNS,
-					)
-
-					// When no resolver gave a reply marked recursion
-					// available, none may have replied at all, so the
-					// attempt is tried again.
-					if err != nil && !strings.Contains(
-						err.Error(), "marked recursion available",
-					) {
-						return fmt.Errorf(
-							"%w: %w", livednstest.ErrNoAnswer, err,
-						)
-					}
-
-					return nil
-				},
-			)
-
-			require.ErrorIs(t, err, resolver.ErrIntercepted)
-
-			// The error names the resolver whose reply ended the
-			// lookup.
-			messages := make([]string, 0, len(resolvers))
-			for _, ip := range resolvers {
-				messages = append(messages,
-					"query "+name+" @"+ip+": reply marked recursion "+
-						"available, so not from a root server: "+
-						"this network intercepts DNS queries",
-				)
-			}
-
-			require.Contains(t, messages, err.Error())
-		}
-	}
-}
-
 func TestQueryNameserver_RecordsSorted(t *testing.T) {
 	t.Parallel()
 
@@ -1492,37 +1424,6 @@ func TestQueryNameserverIP_DeadlineDuringFirstTry(t *testing.T) {
 	assert.NotEmpty(t, resp.Error)
 }
 
-// TestQueryNameserverIP_CancelDuringFirstTry cancels the context while
-// the first try of a query to 192.0.2.1, where nothing answers, waits
-// for a reply. That try's timeout is all that is learned about the
-// nameserver, so it is reported as timed out, not as answering.
-func TestQueryNameserverIP_CancelDuringFirstTry(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-
-	// The first try starts at once and waits two seconds for a reply;
-	// the cancel comes a second in. The DNS client cuts a try short at
-	// the context's deadline but not at a cancel, so the try still
-	// waits its full two seconds and ends as a timeout a second after
-	// the cancel. By then the context has certainly ended, so no second
-	// try is made. With a deadline instead, the try ends at the moment
-	// the context does, and whether a second try is made depends on
-	// which the resolver sees first.
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-	time.AfterFunc(time.Second, cancel)
-
-	resp, err := r.QueryNameserverIP(
-		ctx, "unreachable.test.", "192.0.2.1",
-		"example.com",
-	)
-	require.NoError(t, err)
-
-	assert.Equal(t, resolver.StatusTimeout, resp.Status)
-	assert.NotEmpty(t, resp.Error)
-}
-
 // TestQueryNameserverIP_CancelledLogsNothing cancels the context while
 // a query to 192.0.2.1, where nothing answers, is waiting for a reply,
 // as shutdown does. The query was cut short, not failed, so nothing is