resolver: ask again over TCP when a reply offers recursion (closes #300)

dnswatcher never asks for recursion, so a reply marked recursion
available comes from a resolver on the network answering in the
server's place, as on a network that sends all DNS to one resolver.
Such a resolver answers only from its cache, or with SERVFAIL or
REFUSED, which made make check fail there.

A reply over UDP marked so is now asked again over TCP, which many such
networks leave alone, and the TCP reply is used. A reply from a root
server's address still marked so is not used, and when every root
server refuses or gives one, the error is the existing "this network
intercepts DNS queries".

Model: opus-5-5

README.md

@@ -561,17 +561,16 @@ This approach ensures:
 - Ability to detect split-horizon or inconsistent responses across authoritative
   servers.
 
-A root server never offers recursion, so a reply marked "recursion available"
+dnswatcher never asks a server for recursion, so a reply marked "recursion
-from a root server's address came from a recursive resolver on the network
+available" did not come from the server it was sent to. It came from a recursive
-answering in its place, as on a network where a router rule, a VPN or a DNS
+resolver on the network answering in that server's place, as on a network where
-filter sends all DNS to one resolver. The first such reply from a root server's
+a router rule, a VPN or a DNS filter sends all DNS to one resolver. Such a query
-address, a refusal included, stops the lookup at once with the error "this
+is sent again over TCP, which many of those networks leave alone, and the reply
-network intercepts DNS queries", naming that address, and no other root server
+over TCP is used; when that retry fails, the reply over UDP is kept. A root
-is asked. A lookup that every root server refuses without that mark fails with
+server never offers recursion, so a reply from a root server's address that is
-the same error. Every lookup starts at the root servers, so on such a network
+still marked so after that is passed over. When every root server refuses a
-every lookup fails with that error, whether or not that resolver has the name
+query or gives such a reply, the lookup fails with the error "this network
-cached, and dnswatcher's tests fail there too. That is by design: nothing asks
+intercepts DNS queries".
-again another way or otherwise works around the interception.
 
 A watched name's records are stored as its nameservers return them, CNAME
 included. When they return a CNAME and no address, the chain of every CNAME

TODO.md

@@ -19,10 +19,10 @@ milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
 
 # Completed Steps
 
-- 2026-10-16: the first reply marked "recursion available" from a root server's
+- 2026-10-16: a reply over UDP marked "recursion available" is asked again over
-  address, a refusal included, stops the lookup with "this network intercepts
+  TCP; such a reply from a root server's address is not used, and when every
-  DNS queries", so on a network that sends DNS to a resolver dnswatcher and its
+  root server refuses or gives one, the error is "this network intercepts DNS
-  tests fail, by design (closes #300).
+  queries" (closes #300).
 - 2026-10-15: a query its caller's context ends before it is sent records no
   reason about the nameserver, and a try the context's deadline cuts short is a
   timeout, so a nameserver whose only failures were timeouts is `timeout`, not a

internal/resolver/errors.go

@@ -53,13 +53,18 @@ var (
 		"reply truncated and its retry over TCP failed",
 	)
 
-	// ErrIntercepted is returned when a root server's address gave a
+	// ErrRecursionAvailable is the reason a reply from a root server
-	// reply marked recursion available, a refusal included, which ends
+	// marked recursion available is not used. Root servers offer no
-	// the lookup at once, or when every root server refused a query.
+	// recursion, so the reply came from something on the network
-	// Root servers do neither, so those replies came from something on
+	// answering in their place.
-	// the network answering in their place. On such a network
+	ErrRecursionAvailable = errors.New(
-	// dnswatcher fails with it, by design: nothing works around the
+		"reply marked recursion available, so not from a root server",
-	// interception.
+	)
+
+	// ErrIntercepted is returned when every root server refused a
+	// query or gave a reply marked recursion available. Root servers do
+	// neither, so those replies came from something on the network
+	// answering in their place.
 	ErrIntercepted = errors.New("this network intercepts DNS queries")
 
 	// ErrCNAMEDepthExceeded is returned when a CNAME chain

internal/resolver/iterative.go

@@ -94,15 +94,18 @@ func (r *Resolver) tryExchange(
 }
 
 // retryTCP returns the reply to msg over TCP when resp, its reply over
-// UDP, is truncated. When that fails it returns resp, still truncated,
+// UDP, is truncated or marked recursion available. msg does not ask for
-// which holds only the records that fit.
+// recursion, so a reply marked so came from a recursive resolver on the
+// network answering in the server's place, and many networks that send
+// DNS to one do so only for UDP. When the retry fails it returns resp;
+// a truncated one holds only the records that fit.
 func (r *Resolver) retryTCP(
 	ctx context.Context,
 	msg *dns.Msg,
 	addr string,
 	resp *dns.Msg,
 ) *dns.Msg {
-	if !resp.Truncated {
+	if !resp.Truncated && !resp.RecursionAvailable {
 		return resp
 	}
 
@@ -115,8 +118,9 @@ func (r *Resolver) retryTCP(
 }
 
 // queryDNS sends a DNS query to a specific server IP, never asking it
-// for recursion. A reply of REFUSED is returned together with
+// for recursion. When the reply over UDP is truncated or marked
-// ErrRefused, so that the caller can still read the reply's flags.
+// recursion available, the query is sent again over TCP (see retryTCP).
+// A reply of REFUSED is returned as ErrRefused.
 func (r *Resolver) queryDNS(
 	ctx context.Context,
 	serverIP string,
@@ -139,13 +143,15 @@ func (r *Resolver) queryDNS(
 		return nil, fmt.Errorf("query %s @%s: %w", name, serverIP, err)
 	}
 
+	resp = r.retryTCP(ctx, msg, addr, resp)
+
 	if resp.Rcode == dns.RcodeRefused {
-		return resp, fmt.Errorf(
+		return nil, fmt.Errorf(
 			"query %s @%s: %w", name, serverIP, ErrRefused,
 		)
 	}
 
-	return r.retryTCP(ctx, msg, addr, resp), nil
+	return resp, nil
 }
 
 func extractNSSet(rrs []dns.RR) []string {
@@ -285,15 +291,11 @@ func shuffled(
 }
 
 // queryServers asks servers, the servers of zone, about name in a random
-// order until one gives a usable reply. When they are the root servers,
+// order until one gives a reply it uses (see replyError). A server that
-// the first reply marked recursion available, a refusal included, ends
+// times out, refuses or gives a reply it does not use is passed over for
-// the lookup with ErrIntercepted, naming the address it came from, and
+// the next. When every server refused, the error says so. When they are
-// no other root server is asked: root servers offer no recursion, so
+// the root servers and each one refused or gave a reply marked recursion
-// that reply came from something on the network answering in their
+// available, the error is ErrIntercepted.
-// place. Otherwise a server that times out, refuses or gives a reply
-// that is not usable is passed over for the next. When every server
-// refused, the error says so, and when they are the root servers it is
-// ErrIntercepted.
 func (r *Resolver) queryServers(
 	ctx context.Context,
 	servers []string,
@@ -304,27 +306,16 @@ func (r *Resolver) queryServers(
 	var lastErr error
 
 	refused := 0
+	recursionAvailable := 0
 
 	for _, ip := range shuffled(servers, rand.Shuffle) {
 		if checkCtx(ctx) != nil {
 			return nil, ErrContextCanceled
 		}
 
-		// queryDNS returns a refusal together with its reply, so a
-		// refusal's mark is checked here too.
 		resp, err := r.queryDNS(ctx, ip, name, qtype)
-		if resp != nil && zone == "." && resp.RecursionAvailable {
+		if err == nil {
-			return nil, fmt.Errorf(
+			err = replyError(resp, ip, zone, name)
-				"query %s @%s: reply marked recursion available, "+
-					"so not from a root server: %w",
-				name, ip, ErrIntercepted,
-			)
-		}
-
-		if err == nil && !usableReply(resp, zone, name) {
-			err = fmt.Errorf(
-				"query %s @%s: %w", name, ip, ErrUnusableReply,
-			)
 		}
 
 		if err == nil {
@@ -335,6 +326,10 @@ func (r *Resolver) queryServers(
 			refused++
 		}
 
+		if errors.Is(err, ErrRecursionAvailable) {
+			recursionAvailable++
+		}
+
 		lastErr = err
 	}
 
@@ -345,6 +340,14 @@ func (r *Resolver) queryServers(
 		)
 	}
 
+	if refused+recursionAvailable == len(servers) && zone == "." {
+		return nil, fmt.Errorf(
+			"every root server refused a query for %s or gave a reply "+
+				"marked recursion available: %w",
+			name, ErrIntercepted,
+		)
+	}
+
 	if refused == len(servers) {
 		return nil, fmt.Errorf(
 			"every server of %s refused a query for %s: %w",
@@ -355,6 +358,27 @@ func (r *Resolver) queryServers(
 	return nil, fmt.Errorf("all servers failed: %w", lastErr)
 }
 
+// replyError returns why resp, the reply of the server at ip, one of the
+// servers of zone, to a query about name, is not used, or nil when it
+// is. A reply that is not usable is not used. Nor is a reply from a root
+// server marked recursion available: root servers offer no recursion,
+// so it came from something on the network answering in their place.
+func replyError(resp *dns.Msg, ip string, zone string, name string) error {
+	if zone == "." && resp.RecursionAvailable {
+		return fmt.Errorf(
+			"query %s @%s: %w", name, ip, ErrRecursionAvailable,
+		)
+	}
+
+	if !usableReply(resp, zone, name) {
+		return fmt.Errorf(
+			"query %s @%s: %w", name, ip, ErrUnusableReply,
+		)
+	}
+
+	return nil
+}
+
 // isErrorReply reports whether msg is an error reply: one with any code
 // but NOERROR and NXDOMAIN, such as SERVFAIL, NOTIMP or FORMERR. An error
 // reply says nothing about the name's records.

internal/resolver/resolver_test.go

@@ -851,70 +851,51 @@ func TestQueryServers_NotEveryRootServerRefused(t *testing.T) {
 }
 
 // TestQueryServers_RecursiveResolversAsRootServers passes public
-// recursive resolvers to QueryServers as the servers of the root zone,
+// recursive resolvers of four operators to QueryServers as the servers
-// as a network that sends every DNS query to a resolver would. Their
+// of the root zone, as a network that sends every DNS query to a
-// replies are marked recursion available, which no root server's is:
+// resolver would. Over UDP and over TCP alike, they mark every reply
-// SERVFAIL, REFUSED, or an answer from a resolver's cache, as 1.1.1.1
+// recursion available, which no root server does. Each refuses the
-// gives for com., which would be used if a root server gave it. The
+// query, replies SERVFAIL, or answers from its cache, as 1.1.1.1 does
-// first such reply ends the lookup with ErrIntercepted, naming the
+// for com.: a reply that would be used if a root server gave it. Either
-// resolver that gave it. In the first group the replies differ; every
+// way the error is ErrIntercepted, and since 1.1.1.1 and 8.8.8.8 refuse
-// resolver in the second refuses a query that does not ask for
+// no such query, it says a reply was marked recursion available.
-// recursion, as 9.9.9.9 does, so there a refusal ends the lookup
-// instead of being passed over. Each group has resolvers of four
-// operators, and a resolver that gives no reply is passed over for the
-// next, so one of them answering is enough.
 func TestQueryServers_RecursiveResolversAsRootServers(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	groups := [][]string{
+	resolvers := []string{
-		{"1.1.1.1", "8.8.8.8", "9.9.9.9", "208.67.222.222"},
+		"1.1.1.1", "8.8.8.8", "9.9.9.9", "208.67.222.222",
-		{"64.6.64.6", "185.222.222.222", "4.2.2.1", "94.140.14.14"},
 	}
 
-	for _, resolvers := range groups {
+	for _, name := range []string{"com.", "desec.io."} {
-		for _, name := range []string{"com.", "desec.io."} {
+		var err error
-			var err error
 
-			livednstest.Retry(
+		livednstest.Retry(
-				t,
+			t,
-				"QueryServers("+strings.Join(resolvers, ", ")+
+			"QueryServers(public recursive resolvers as root servers, "+
-					" as root servers, "+name+")",
+				name+")",
-				func(ctx context.Context) error {
+			func(ctx context.Context) error {
-					_, err = r.QueryServers(
+				_, err = r.QueryServers(ctx, resolvers, ".", name, dns.TypeNS)
-						ctx, resolvers, ".", name, dns.TypeNS,
+
+				// When the error is another, one resolver may have given
+				// no reply at all, so the attempt is tried again.
+				if err != nil && !errors.Is(err, resolver.ErrIntercepted) {
+					return fmt.Errorf(
+						"%w: %w", livednstest.ErrNoAnswer, err,
 					)
+				}
 
-					// When no resolver gave a reply marked recursion
+				return nil
-					// available, none may have replied at all, so the
+			},
-					// attempt is tried again.
+		)
-					if err != nil && !strings.Contains(
-						err.Error(), "marked recursion available",
-					) {
-						return fmt.Errorf(
-							"%w: %w", livednstest.ErrNoAnswer, err,
-						)
-					}
 
-					return nil
+		require.ErrorIs(t, err, resolver.ErrIntercepted)
-				},
+		require.EqualError(
-			)
+			t, err,
-
+			"every root server refused a query for "+name+" or gave a "+
-			require.ErrorIs(t, err, resolver.ErrIntercepted)
+				"reply marked recursion available: "+
-
+				"this network intercepts DNS queries",
-			// The error names the resolver whose reply ended the
+		)
-			// lookup.
-			messages := make([]string, 0, len(resolvers))
-			for _, ip := range resolvers {
-				messages = append(messages,
-					"query "+name+" @"+ip+": reply marked recursion "+
-						"available, so not from a root server: "+
-						"this network intercepts DNS queries",
-				)
-			}
-
-			require.Contains(t, messages, err.Error())
-		}
 	}
 }