resolver: a reply marked recursion available from a root server's address stops the lookup (closes #300)

dnswatcher never asks for recursion and a root server never offers it,
so a reply marked recursion available from a root server's address
came from a resolver on the network answering in its place. The first
such reply now stops the lookup at once with the existing "this network
intercepts DNS queries", naming the address, and no other root server
is asked, whether or not that resolver had the name cached. Before, a
cached name was checked against the resolver's second-hand answer.

On such a network dnswatcher and its tests fail with that error, by
design; nothing works around the interception. A live test passes
public resolvers as the root servers and expects the error.

Model: opus-5-5

README.md

@@ -565,13 +565,13 @@ A root server never offers recursion, so a reply marked "recursion available"
 from a root server's address came from a recursive resolver on the network
 answering in its place, as on a network where a router rule, a VPN or a DNS
 filter sends all DNS to one resolver. The first such reply from a root server's
-address, a refusal included, stops the lookup at once with the error "this
+address stops the lookup at once with the error "this network intercepts DNS
-network intercepts DNS queries", naming that address, and no other root server
+queries", and no other root server is asked. A lookup that every root server
-is asked. A lookup that every root server refuses without that mark fails with
+refuses fails with the same error. Every lookup starts at the root servers, so
-the same error. Every lookup starts at the root servers, so on such a network
+on such a network every lookup fails with that error, whether or not that
-every lookup fails with that error, whether or not that resolver has the name
+resolver has the name cached, and dnswatcher's tests fail there too. That is by
-cached, and dnswatcher's tests fail there too. That is by design: nothing asks
+design: nothing asks again another way or otherwise works around the
-again another way or otherwise works around the interception.
+interception.
 
 A watched name's records are stored as its nameservers return them, CNAME
 included. When they return a CNAME and no address, the chain of every CNAME

TODO.md

@@ -20,9 +20,9 @@ milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
 # Completed Steps
 
 - 2026-10-16: the first reply marked "recursion available" from a root server's
-  address, a refusal included, stops the lookup with "this network intercepts
+  address stops the lookup with "this network intercepts DNS queries", so on a
-  DNS queries", so on a network that sends DNS to a resolver dnswatcher and its
+  network that sends DNS to a resolver dnswatcher and its tests fail, by design
-  tests fail, by design (closes #300).
+  (closes #300).
 - 2026-10-15: a query its caller's context ends before it is sent records no
   reason about the nameserver, and a try the context's deadline cuts short is a
   timeout, so a nameserver whose only failures were timeouts is `timeout`, not a

internal/resolver/errors.go

@@ -54,12 +54,11 @@ var (
 	)
 
 	// ErrIntercepted is returned when a root server's address gave a
-	// reply marked recursion available, a refusal included, which ends
+	// reply marked recursion available, which ends the lookup at once,
-	// the lookup at once, or when every root server refused a query.
+	// or when every root server refused a query. Root servers do
-	// Root servers do neither, so those replies came from something on
+	// neither, so those replies came from something on the network
-	// the network answering in their place. On such a network
+	// answering in their place. On such a network dnswatcher fails with
-	// dnswatcher fails with it, by design: nothing works around the
+	// it, by design: nothing works around the interception.
-	// interception.
 	ErrIntercepted = errors.New("this network intercepts DNS queries")
 
 	// ErrCNAMEDepthExceeded is returned when a CNAME chain

internal/resolver/iterative.go

@@ -115,8 +115,7 @@ func (r *Resolver) retryTCP(
 }
 
 // queryDNS sends a DNS query to a specific server IP, never asking it
-// for recursion. A reply of REFUSED is returned together with
+// for recursion. A reply of REFUSED is returned as ErrRefused.
-// ErrRefused, so that the caller can still read the reply's flags.
 func (r *Resolver) queryDNS(
 	ctx context.Context,
 	serverIP string,
@@ -140,7 +139,7 @@ func (r *Resolver) queryDNS(
 	}
 
 	if resp.Rcode == dns.RcodeRefused {
-		return resp, fmt.Errorf(
+		return nil, fmt.Errorf(
 			"query %s @%s: %w", name, serverIP, ErrRefused,
 		)
 	}
@@ -285,15 +284,14 @@ func shuffled(
 }
 
 // queryServers asks servers, the servers of zone, about name in a random
-// order until one gives a usable reply. When they are the root servers,
+// order until one gives a usable reply. A server that times out, refuses
-// the first reply marked recursion available, a refusal included, ends
+// or gives a reply that is not usable is passed over for the next. When
-// the lookup with ErrIntercepted, naming the address it came from, and
+// every server refused, the error says so, and when they are the root
-// no other root server is asked: root servers offer no recursion, so
+// servers it is ErrIntercepted. When they are the root servers, the
-// that reply came from something on the network answering in their
+// first reply marked recursion available also ends the lookup with
-// place. Otherwise a server that times out, refuses or gives a reply
+// ErrIntercepted, naming the address it came from, and no other root
-// that is not usable is passed over for the next. When every server
+// server is asked: root servers offer no recursion, so that reply came
-// refused, the error says so, and when they are the root servers it is
+// from something on the network answering in their place.
-// ErrIntercepted.
 func (r *Resolver) queryServers(
 	ctx context.Context,
 	servers []string,
@@ -310,10 +308,8 @@ func (r *Resolver) queryServers(
 			return nil, ErrContextCanceled
 		}
 
-		// queryDNS returns a refusal together with its reply, so a
-		// refusal's mark is checked here too.
 		resp, err := r.queryDNS(ctx, ip, name, qtype)
-		if resp != nil && zone == "." && resp.RecursionAvailable {
+		if err == nil && zone == "." && resp.RecursionAvailable {
 			return nil, fmt.Errorf(
 				"query %s @%s: reply marked recursion available, "+
 					"so not from a root server: %w",

internal/resolver/resolver_test.go

@@ -851,70 +851,59 @@ func TestQueryServers_NotEveryRootServerRefused(t *testing.T) {
 }
 
 // TestQueryServers_RecursiveResolversAsRootServers passes public
-// recursive resolvers to QueryServers as the servers of the root zone,
+// recursive resolvers of four operators to QueryServers as the servers
-// as a network that sends every DNS query to a resolver would. Their
+// of the root zone, as a network that sends every DNS query to a
-// replies are marked recursion available, which no root server's is:
+// resolver would. Their replies are marked recursion available, which
-// SERVFAIL, REFUSED, or an answer from a resolver's cache, as 1.1.1.1
+// no root server's is: SERVFAIL, or an answer from a resolver's cache,
-// gives for com., which would be used if a root server gave it. The
+// as 1.1.1.1 gives for com., which would be used if a root server gave
-// first such reply ends the lookup with ErrIntercepted, naming the
+// it. The first such reply ends the lookup with ErrIntercepted, naming
-// resolver that gave it. In the first group the replies differ; every
+// the resolver that gave it. A resolver that refuses or gives no reply
-// resolver in the second refuses a query that does not ask for
+// is passed over for the next, so one of them answering is enough.
-// recursion, as 9.9.9.9 does, so there a refusal ends the lookup
-// instead of being passed over. Each group has resolvers of four
-// operators, and a resolver that gives no reply is passed over for the
-// next, so one of them answering is enough.
 func TestQueryServers_RecursiveResolversAsRootServers(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	groups := [][]string{
+	resolvers := []string{
-		{"1.1.1.1", "8.8.8.8", "9.9.9.9", "208.67.222.222"},
+		"1.1.1.1", "8.8.8.8", "9.9.9.9", "208.67.222.222",
-		{"64.6.64.6", "185.222.222.222", "4.2.2.1", "94.140.14.14"},
 	}
 
-	for _, resolvers := range groups {
+	for _, name := range []string{"com.", "desec.io."} {
-		for _, name := range []string{"com.", "desec.io."} {
+		var err error
-			var err error
 
-			livednstest.Retry(
+		livednstest.Retry(
-				t,
+			t,
-				"QueryServers("+strings.Join(resolvers, ", ")+
+			"QueryServers(public recursive resolvers as root servers, "+
-					" as root servers, "+name+")",
+				name+")",
-				func(ctx context.Context) error {
+			func(ctx context.Context) error {
-					_, err = r.QueryServers(
+				_, err = r.QueryServers(ctx, resolvers, ".", name, dns.TypeNS)
-						ctx, resolvers, ".", name, dns.TypeNS,
+
+				// When no resolver gave a reply marked recursion
+				// available, each refused or gave no reply at all, so
+				// the attempt is tried again.
+				if err != nil &&
+					!strings.Contains(err.Error(), "marked recursion available") {
+					return fmt.Errorf(
+						"%w: %w", livednstest.ErrNoAnswer, err,
 					)
+				}
 
-					// When no resolver gave a reply marked recursion
+				return nil
-					// available, none may have replied at all, so the
+			},
-					// attempt is tried again.
+		)
-					if err != nil && !strings.Contains(
-						err.Error(), "marked recursion available",
-					) {
-						return fmt.Errorf(
-							"%w: %w", livednstest.ErrNoAnswer, err,
-						)
-					}
 
-					return nil
+		require.ErrorIs(t, err, resolver.ErrIntercepted)
-				},
+
+		// The error names the resolver whose reply ended the lookup.
+		messages := make([]string, 0, len(resolvers))
+		for _, ip := range resolvers {
+			messages = append(messages,
+				"query "+name+" @"+ip+": reply marked recursion "+
+					"available, so not from a root server: "+
+					"this network intercepts DNS queries",
 			)
-
-			require.ErrorIs(t, err, resolver.ErrIntercepted)
-
-			// The error names the resolver whose reply ended the
-			// lookup.
-			messages := make([]string, 0, len(resolvers))
-			for _, ip := range resolvers {
-				messages = append(messages,
-					"query "+name+" @"+ip+": reply marked recursion "+
-						"available, so not from a root server: "+
-						"this network intercepts DNS queries",
-				)
-			}
-
-			require.Contains(t, messages, err.Error())
 		}
+
+		require.Contains(t, messages, err.Error())
 	}
 }