resolver: a root server's reply marked recursion available means interception (closes #300)

dnswatcher never asks for recursion and a root server never offers it,
so a reply marked recursion available from a root server's address
came from a resolver on the network answering in its place. Such a
reply is now passed over, and when every root server refused or gave
one, the lookup fails with the existing "this network intercepts DNS
queries", whether or not that resolver had the name cached. Before, a
cached name was checked against the resolver's second-hand answer.

On such a network dnswatcher and its tests fail with that error, by
design; nothing asks again another way or works around it. A live test
passes public resolvers as the root servers and expects the error.

Model: opus-5-5

README.md

@@ -564,14 +564,13 @@ This approach ensures:
 A root server never offers recursion, so a reply marked "recursion available"
 from a root server's address came from a recursive resolver on the network
 answering in its place, as on a network where a router rule, a VPN or a DNS
-filter sends all DNS to one resolver. The first such reply from a root server's
+filter sends all DNS to one resolver. Such a reply is passed over for the next
-address, a refusal included, stops the lookup at once with the error "this
+root server. When every root server refuses a query or gives such a reply, the
-network intercepts DNS queries", naming that address, and no other root server
+lookup fails with the error "this network intercepts DNS queries". Every lookup
-is asked. A lookup that every root server refuses without that mark fails with
+starts at the root servers, so on such a network every lookup fails with that
-the same error. Every lookup starts at the root servers, so on such a network
+error, whether or not that resolver has the name cached, and dnswatcher's tests
-every lookup fails with that error, whether or not that resolver has the name
+fail there too. That is by design: nothing asks again another way or otherwise
-cached, and dnswatcher's tests fail there too. That is by design: nothing asks
+works around the interception.
-again another way or otherwise works around the interception.
 
 A watched name's records are stored as its nameservers return them, CNAME
 included. When they return a CNAME and no address, the chain of every CNAME

TODO.md

@@ -19,10 +19,10 @@ milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
 
 # Completed Steps
 
-- 2026-10-16: the first reply marked "recursion available" from a root server's
+- 2026-10-16: a reply marked "recursion available" from a root server's address
-  address, a refusal included, stops the lookup with "this network intercepts
+  is not used; when every root server refuses or gives one, the lookup fails
-  DNS queries", so on a network that sends DNS to a resolver dnswatcher and its
+  with "this network intercepts DNS queries", so on such a network dnswatcher
-  tests fail, by design (closes #300).
+  and its tests fail, by design (closes #300).
 - 2026-10-15: a query its caller's context ends before it is sent records no
   reason about the nameserver, and a try the context's deadline cuts short is a
   timeout, so a nameserver whose only failures were timeouts is `timeout`, not a

internal/resolver/errors.go

@@ -53,13 +53,19 @@ var (
 		"reply truncated and its retry over TCP failed",
 	)
 
-	// ErrIntercepted is returned when a root server's address gave a
+	// ErrRecursionAvailable is the reason a reply from a root server's
-	// reply marked recursion available, a refusal included, which ends
+	// address marked recursion available is not used. Root servers offer
-	// the lookup at once, or when every root server refused a query.
+	// no recursion, so the reply came from something on the network
-	// Root servers do neither, so those replies came from something on
+	// answering in their place.
-	// the network answering in their place. On such a network
+	ErrRecursionAvailable = errors.New(
-	// dnswatcher fails with it, by design: nothing works around the
+		"reply marked recursion available, so not from a root server",
-	// interception.
+	)
+
+	// ErrIntercepted is returned when every root server refused a
+	// query or gave a reply marked recursion available. Root servers do
+	// neither, so those replies came from something on the network
+	// answering in their place. On such a network dnswatcher fails with
+	// it, by design: nothing works around the interception.
 	ErrIntercepted = errors.New("this network intercepts DNS queries")
 
 	// ErrCNAMEDepthExceeded is returned when a CNAME chain

internal/resolver/iterative.go

@@ -115,8 +115,7 @@ func (r *Resolver) retryTCP(
 }
 
 // queryDNS sends a DNS query to a specific server IP, never asking it
-// for recursion. A reply of REFUSED is returned together with
+// for recursion. A reply of REFUSED is returned as ErrRefused.
-// ErrRefused, so that the caller can still read the reply's flags.
 func (r *Resolver) queryDNS(
 	ctx context.Context,
 	serverIP string,
@@ -140,7 +139,7 @@ func (r *Resolver) queryDNS(
 	}
 
 	if resp.Rcode == dns.RcodeRefused {
-		return resp, fmt.Errorf(
+		return nil, fmt.Errorf(
 			"query %s @%s: %w", name, serverIP, ErrRefused,
 		)
 	}
@@ -285,15 +284,11 @@ func shuffled(
 }
 
 // queryServers asks servers, the servers of zone, about name in a random
-// order until one gives a usable reply. When they are the root servers,
+// order until one gives a reply it uses (see replyError). A server that
-// the first reply marked recursion available, a refusal included, ends
+// times out, refuses or gives a reply it does not use is passed over for
-// the lookup with ErrIntercepted, naming the address it came from, and
+// the next. When every server refused, the error says so. When they are
-// no other root server is asked: root servers offer no recursion, so
+// the root servers and each one refused or gave a reply marked recursion
-// that reply came from something on the network answering in their
+// available, the error is ErrIntercepted.
-// place. Otherwise a server that times out, refuses or gives a reply
-// that is not usable is passed over for the next. When every server
-// refused, the error says so, and when they are the root servers it is
-// ErrIntercepted.
 func (r *Resolver) queryServers(
 	ctx context.Context,
 	servers []string,
@@ -304,27 +299,16 @@ func (r *Resolver) queryServers(
 	var lastErr error
 
 	refused := 0
+	recursionAvailable := 0
 
 	for _, ip := range shuffled(servers, rand.Shuffle) {
 		if checkCtx(ctx) != nil {
 			return nil, ErrContextCanceled
 		}
 
-		// queryDNS returns a refusal together with its reply, so a
-		// refusal's mark is checked here too.
 		resp, err := r.queryDNS(ctx, ip, name, qtype)
-		if resp != nil && zone == "." && resp.RecursionAvailable {
+		if err == nil {
-			return nil, fmt.Errorf(
+			err = replyError(resp, ip, zone, name)
-				"query %s @%s: reply marked recursion available, "+
-					"so not from a root server: %w",
-				name, ip, ErrIntercepted,
-			)
-		}
-
-		if err == nil && !usableReply(resp, zone, name) {
-			err = fmt.Errorf(
-				"query %s @%s: %w", name, ip, ErrUnusableReply,
-			)
 		}
 
 		if err == nil {
@@ -335,6 +319,10 @@ func (r *Resolver) queryServers(
 			refused++
 		}
 
+		if errors.Is(err, ErrRecursionAvailable) {
+			recursionAvailable++
+		}
+
 		lastErr = err
 	}
 
@@ -345,6 +333,14 @@ func (r *Resolver) queryServers(
 		)
 	}
 
+	if refused+recursionAvailable == len(servers) && zone == "." {
+		return nil, fmt.Errorf(
+			"every root server refused a query for %s or gave a reply "+
+				"marked recursion available: %w",
+			name, ErrIntercepted,
+		)
+	}
+
 	if refused == len(servers) {
 		return nil, fmt.Errorf(
 			"every server of %s refused a query for %s: %w",
@@ -355,6 +351,27 @@ func (r *Resolver) queryServers(
 	return nil, fmt.Errorf("all servers failed: %w", lastErr)
 }
 
+// replyError returns why resp, the reply of the server at ip, one of the
+// servers of zone, to a query about name, is not used, or nil when it
+// is. A reply that is not usable is not used. Nor is a reply from a root
+// server marked recursion available: root servers offer no recursion,
+// so it came from something on the network answering in their place.
+func replyError(resp *dns.Msg, ip string, zone string, name string) error {
+	if zone == "." && resp.RecursionAvailable {
+		return fmt.Errorf(
+			"query %s @%s: %w", name, ip, ErrRecursionAvailable,
+		)
+	}
+
+	if !usableReply(resp, zone, name) {
+		return fmt.Errorf(
+			"query %s @%s: %w", name, ip, ErrUnusableReply,
+		)
+	}
+
+	return nil
+}
+
 // isErrorReply reports whether msg is an error reply: one with any code
 // but NOERROR and NXDOMAIN, such as SERVFAIL, NOTIMP or FORMERR. An error
 // reply says nothing about the name's records.

internal/resolver/resolver_test.go

@@ -851,46 +851,35 @@ func TestQueryServers_NotEveryRootServerRefused(t *testing.T) {
 }
 
 // TestQueryServers_RecursiveResolversAsRootServers passes public
-// recursive resolvers to QueryServers as the servers of the root zone,
+// recursive resolvers of four operators to QueryServers as the servers
-// as a network that sends every DNS query to a resolver would. Their
+// of the root zone, as a network that sends every DNS query to a
-// replies are marked recursion available, which no root server's is:
+// resolver would. Each refuses the query or gives a reply marked
-// SERVFAIL, REFUSED, or an answer from a resolver's cache, as 1.1.1.1
+// recursion available, which no root server does: SERVFAIL, or an
-// gives for com., which would be used if a root server gave it. The
+// answer from its cache, as 1.1.1.1 gives for com., which would be used
-// first such reply ends the lookup with ErrIntercepted, naming the
+// if a root server gave it. Either way the error is ErrIntercepted, and
-// resolver that gave it. In the first group the replies differ; every
+// since 1.1.1.1 and 8.8.8.8 refuse no such query, it says a reply was
-// resolver in the second refuses a query that does not ask for
+// marked recursion available.
-// recursion, as 9.9.9.9 does, so there a refusal ends the lookup
-// instead of being passed over. Each group has resolvers of four
-// operators, and a resolver that gives no reply is passed over for the
-// next, so one of them answering is enough.
 func TestQueryServers_RecursiveResolversAsRootServers(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	groups := [][]string{
+	resolvers := []string{
-		{"1.1.1.1", "8.8.8.8", "9.9.9.9", "208.67.222.222"},
+		"1.1.1.1", "8.8.8.8", "9.9.9.9", "208.67.222.222",
-		{"64.6.64.6", "185.222.222.222", "4.2.2.1", "94.140.14.14"},
 	}
 
-	for _, resolvers := range groups {
 	for _, name := range []string{"com.", "desec.io."} {
 		var err error
 
 		livednstest.Retry(
 			t,
-				"QueryServers("+strings.Join(resolvers, ", ")+
+			"QueryServers(public recursive resolvers as root servers, "+
-					" as root servers, "+name+")",
+				name+")",
 			func(ctx context.Context) error {
-					_, err = r.QueryServers(
+				_, err = r.QueryServers(ctx, resolvers, ".", name, dns.TypeNS)
-						ctx, resolvers, ".", name, dns.TypeNS,
-					)
 
-					// When no resolver gave a reply marked recursion
+				// When the error is another, one resolver may have given
-					// available, none may have replied at all, so the
+				// no reply at all, so the attempt is tried again.
-					// attempt is tried again.
+				if err != nil && !errors.Is(err, resolver.ErrIntercepted) {
-					if err != nil && !strings.Contains(
-						err.Error(), "marked recursion available",
-					) {
 					return fmt.Errorf(
 						"%w: %w", livednstest.ErrNoAnswer, err,
 					)
@@ -901,21 +890,13 @@ func TestQueryServers_RecursiveResolversAsRootServers(t *testing.T) {
 		)
 
 		require.ErrorIs(t, err, resolver.ErrIntercepted)
-
+		require.EqualError(
-			// The error names the resolver whose reply ended the
+			t, err,
-			// lookup.
+			"every root server refused a query for "+name+" or gave a "+
-			messages := make([]string, 0, len(resolvers))
+				"reply marked recursion available: "+
-			for _, ip := range resolvers {
-				messages = append(messages,
-					"query "+name+" @"+ip+": reply marked recursion "+
-						"available, so not from a root server: "+
 				"this network intercepts DNS queries",
 		)
 	}
-
-			require.Contains(t, messages, err.Error())
-		}
-	}
 }
 
 func TestQueryNameserver_RecordsSorted(t *testing.T) {