resolver: a domain's nameservers are only its own delegation (closes #222)

LookupNS now follows the delegation for the domain alone. When the parent
zone's servers answer that it has no delegation, as for a domain that does
not exist, the set is empty, and the watcher's NS comparison reports every
nameserver removed.

FindAuthoritativeNameservers, used for hostnames, still moves to a parent
name when the servers answer that the name has no delegation of its own,
but returns the error when they do not answer, where it used to take a
parent zone's nameservers. The fallback walk treats an authoritative
answer the same way.

A domain with no delegation still has its own records asked at the
servers of the zone it is in.

Model: opus-5-5

README.md

@@ -74,20 +74,12 @@ notification endpoint set, changes show only on the dashboard; see
 - Queries **every** discovered authoritative nameserver independently.
 - Stores the domain's NS record set, as its parent zone's servers delegate it,
   and the IPv4 and IPv6 addresses each nameserver's name resolves to. The set is
-  only ever the domain's own delegation. A domain whose parent zone's servers
-  answer NXDOMAIN, that it does not exist, has no nameservers and is shown as
-  not existing (see Web Dashboard and HTTP API). A domain that exists but has no
-  delegation of its own, such as `octocat.github.io`, has no nameservers either.
-  When the parent zone's servers do not answer, the check fails and the set from
-  the previous check is kept.
+  only ever the domain's own delegation: a domain that its parent zone's servers
+  answer does not exist, or has no delegation, has no nameservers. When they do
+  not answer, the check fails and the set from the previous check is kept.
 - Any change triggers a notification:
     - NS added to or removed from that set. A domain that had nameservers on the
       previous check and no longer exists gets one with all of them removed.
-      After an upgrade, a domain with no delegation of its own, for which an
-      earlier version saved its parent zone's nameservers, also gets one with
-      all of them removed, on its first check. That one does not mean the domain
-      stopped existing: it is not shown as not existing, and its records are
-      still watched.
     - NS address change: a nameserver that stays in the set resolves to
       different addresses than on the previous check. A nameserver added or
       removed gets only the NS change notification. When the lookup of a
@@ -99,10 +91,9 @@ notification endpoint set, changes show only on the dashboard; see
   records, stored per nameserver. Their changes are notified as a hostname's
   are, as a record change, NS query failure, NS recovery, inconsistency or CNAME
   address change, in a message that starts `Domain:` where a hostname's starts
-  `Hostname:`. A domain with no delegation of its own has these records asked at
-  the servers of the zone it is in, as a hostname has. A domain that does not
-  exist has none: they are not asked for, and those saved by an earlier check
-  are removed without a notification.
+  `Hostname:`. A domain with no nameservers of its own has these records asked
+  at the servers of the zone it is in, as a hostname has: for a `.com` domain
+  that does not exist, the `.com` servers, which answer that it does not exist.
 
 ### DNS Hostname Monitoring (Subdomains)
 
@@ -112,9 +103,8 @@ notification endpoint set, changes show only on the dashboard; see
   authoritative nameservers of the zone the hostname is in, which is not always
   its last two labels (a name under `co.uk`, or in a delegated subdomain). The
   trace moves from a name to its parent only when the servers asked answer that
-  the name has no delegation of its own, or does not exist. When they do not
-  answer, the check fails and the hostname's records from the previous check are
-  kept.
+  the name has no delegation of its own. When they do not answer, the check
+  fails and the hostname's records from the previous check are kept.
 - Queries **each** authoritative nameserver independently for **all** record
   types: A, AAAA, CNAME, MX, TXT, SRV, CAA, NS.
 - Each record type is a query of its own. When a nameserver answers some types
@@ -279,9 +269,8 @@ dnswatcher includes an unauthenticated, read-only web dashboard at the root URL
 (`/`). It displays:
 
 - **Summary counts** for monitored domains, hostnames, ports, and certificates.
-- **Domains** with their discovered nameservers, or "does not exist" for a
-  domain whose parent zone's servers answered NXDOMAIN, and each domain's own
-  records per nameserver and status, shown as a hostname's are.
+- **Domains** with their discovered nameservers, and each domain's own records
+  per nameserver and status, shown as a hostname's are.
 - **Hostnames** with per-nameserver DNS records and status. For a nameserver
   whose query failed, the reason is shown in place of the records.
 - **Ports** with open/closed state and the domains and hostnames that resolve to
@@ -318,11 +307,9 @@ In `/api/v1/status`, each nameserver entry and certificate entry whose `status`
 is `error` also has `error`, the reason, as in the state file (see State File
 Format). A domain's own records are in its entry in `domains`, under
 `recordsByNameserver`, in the form a hostname's entry in `hostnames` has them
-under `nameservers`; `hostnames` and `counts.hostnames` hold no domain. A domain
-entry's `nxdomain` is `true` when the domain's parent zone's servers answered
-NXDOMAIN, that it does not exist; its `nameservers` and `recordsByNameserver`
-are then empty. A port entry lists the domains that resolve to its address in
-`domains`, and the hostnames in `hostnames`.
+under `nameservers`; `hostnames` and `counts.hostnames` hold no domain. A port
+entry lists the domains that resolve to its address in `domains`, and the
+hostnames in `hostnames`.
 
 `/metrics` is served only when `DNSWATCHER_METRICS_USERNAME` is set, behind
 Basic Auth. It has the Prometheus Go client's default metrics only (Go runtime,
@@ -610,11 +597,6 @@ nothing for it. Both lists are left out when empty.
 resolves to. A state file without it loads, and the next check fills it in
 without a notification.
 
-A domain entry has `"nxdomain": true` when the domain's parent zone's servers
-answered NXDOMAIN, that it does not exist. Its `nameservers` and
-`nameserverAddresses` are then empty, and `hostnames` holds no entry for it.
-`nxdomain` is left out when false.
-
 `cnameAddresses` lists the sorted addresses at the end of the chain of every
 CNAME target a hostname's nameservers gave, found when they answered with a
 CNAME and no address; it is empty when they answered with an address. When a

TODO.md

@@ -19,12 +19,8 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 # Completed Steps
 
-- 2026-10-02: a nameserver whose query for one record type failed while the
-  others answered with no records is `ok`, not `nodata` (closes #253).
-- 2026-10-02: a domain that does not exist is shown so, with no nameservers; no
-  name gets a parent's nameservers when its own did not answer (closes #222).
-- 2026-10-02: the refused-query test sends one query to four operators' public
-  resolvers in turn until one replies, not eight to one operator (closes #251).
+- 2026-10-02: a domain that does not exist has no nameservers, not its parent
+  zone's; no name gets a parent's when its servers did not answer (closes #222).
 - 2026-10-02: a name removed from `DNSWATCHER_TARGETS` leaves the state, and so
   the dashboard and API, at startup, before the first check (closes #223).
 - 2026-10-02: a record type whose query to a nameserver fails keeps its previous

internal/handlers/dashboard_test.go

@@ -191,39 +191,21 @@ func TestDashboardShowsDomainRecordsUnderDomains(t *testing.T) {
 
 	words := strings.Join(strings.Fields(page), " ")
 
-	footer := "monitoring 2 domains + 1 hostnames"
+	footer := "monitoring 1 domains + 1 hostnames"
 	if !strings.Contains(words, footer) {
 		t.Errorf("dashboard does not say %q", footer)
 	}
 
-	// With the tags taken out, the summary bar starts "Domains 2
+	// With the tags taken out, the summary bar starts "Domains 1
 	// Hostnames 1".
 	text := regexp.MustCompile(`<[^>]*>`).ReplaceAllString(page, " ")
-	summary := "Domains 2 Hostnames 1"
+	summary := "Domains 1 Hostnames 1"
 
 	if !strings.Contains(strings.Join(strings.Fields(text), " "), summary) {
 		t.Errorf("summary bar does not say %q", summary)
 	}
 }
 
-// TestDashboardMarksDomainThatDoesNotExist checks that the Domains
-// section says a domain that does not exist does not exist, and does
-// not say so of a domain that exists.
-func TestDashboardMarksDomainThatDoesNotExist(t *testing.T) {
-	t.Parallel()
-
-	page := get(t, newHandlersWithFailures(t).HandleDashboard())
-	domains := dashboardSection(t, page, "Domains")
-
-	if !strings.Contains(dashboardRow(t, domains, missingDomain), "does not exist") {
-		t.Errorf("row of %s does not say it does not exist", missingDomain)
-	}
-
-	if strings.Contains(dashboardRow(t, domains, testDomain), "does not exist") {
-		t.Errorf("row of %s says it does not exist", testDomain)
-	}
-}
-
 // rowCells returns the text of each cell of a dashboard table row
 // whose cells start with tag, "<th" or "<td".
 func rowCells(row string, tag string) []string {

internal/handlers/status.go

@@ -10,12 +10,10 @@ import (
 
 // statusDomainInfo holds status information for a monitored domain.
 // RecordsByNameserver holds the domain's own records, in the form a
-// hostname's Nameservers holds the hostname's. NXDomain is true when
-// the domain's parent zone's servers answered that it does not exist.
+// hostname's Nameservers holds the hostname's.
 type statusDomainInfo struct {
 	Nameservers         []string                         `json:"nameservers"`
 	RecordsByNameserver map[string]*statusHostnameNSInfo `json:"recordsByNameserver"`
-	NXDomain            bool                             `json:"nxdomain"`
 	LastChecked         time.Time                        `json:"lastChecked"`
 }
 
@@ -157,7 +155,6 @@ func buildDomains(
 		resp.Domains[name] = &statusDomainInfo{
 			Nameservers:         ns,
 			RecordsByNameserver: records,
-			NXDomain:            ds.NXDomain,
 			LastChecked:         ds.LastChecked,
 		}
 	}

internal/handlers/status_test.go

@@ -23,10 +23,7 @@ import (
 // failed. example.net is an apex domain, whose own records are saved
 // with the hostnames' records, as the watcher saves them. Both names
 // resolve to domainAddress, whose port 443 entry lists them.
-// missingDomain is an apex domain whose parent zone's servers answered
-// that it does not exist, saved with no nameservers and no records.
 const (
-	missingDomain    = "does-not-exist.example"
 	testHostname     = "www.example.com"
 	answeringNS      = "ns1.example.com."
 	failedNS         = "ns2.example.com."
@@ -135,12 +132,6 @@ func setTestState(st *state.State) {
 		Hostnames:   []string{testDomain, testHostname},
 		LastChecked: now,
 	})
-
-	st.SetDomainState(missingDomain, &state.DomainState{
-		Nameservers: []string{},
-		NXDomain:    true,
-		LastChecked: now,
-	})
 }
 
 // get serves one GET request to handler and returns the response body.
@@ -242,39 +233,6 @@ func TestStatusGivesDomainRecordsUnderTheDomain(t *testing.T) {
 	}
 }
 
-// TestStatusMarksDomainThatDoesNotExist checks that /api/v1/status sets
-// nxdomain for a domain that does not exist, with no nameservers or
-// records, and not for a domain that exists.
-func TestStatusMarksDomainThatDoesNotExist(t *testing.T) {
-	t.Parallel()
-
-	body := get(t, newHandlersWithFailures(t).HandleStatus())
-
-	var resp struct {
-		Domains map[string]struct {
-			Nameservers         []string       `json:"nameservers"`
-			RecordsByNameserver map[string]any `json:"recordsByNameserver"`
-			NXDomain            bool           `json:"nxdomain"`
-		} `json:"domains"`
-	}
-
-	err := json.Unmarshal([]byte(body), &resp)
-	if err != nil {
-		t.Fatalf("decoding response: %v", err)
-	}
-
-	missing := resp.Domains[missingDomain]
-	if !missing.NXDomain || len(missing.Nameservers) != 0 ||
-		len(missing.RecordsByNameserver) != 0 {
-		t.Errorf("domain %s = %+v, want nxdomain and nothing else",
-			missingDomain, missing)
-	}
-
-	if resp.Domains[testDomain].NXDomain {
-		t.Errorf("domain %s has nxdomain set", testDomain)
-	}
-}
-
 // TestStatusPortsTellDomainsFromHostnames checks that a port entry in
 // /api/v1/status lists an apex domain in domains and a hostname in
 // hostnames when both resolve to its address.

internal/handlers/templates/dashboard.html

@@ -84,11 +84,7 @@
                   {{ $name }}
                 </td>
                 <td class="py-2 px-3 text-slate-400 break-all">
-                  {{ if $ds.NXDomain }}
-                  <span class="text-red-400">does not exist</span>
-                  {{ else }}
                   {{ joinStrings $ds.Nameservers ", " }}
-                  {{ end }}
                 </td>
                 <td class="py-2 px-3 text-slate-500 whitespace-nowrap">
                   {{ relTime $ds.LastChecked }}

internal/resolver/errors.go

@@ -10,10 +10,6 @@ var (
 		"no authoritative nameservers found",
 	)
 
-	// ErrNXDomain is returned when the servers of the zone a domain
-	// is in answer NXDOMAIN: the domain does not exist.
-	ErrNXDomain = errors.New("domain does not exist")
-
 	// ErrNoNameserverAnswered is returned when every nameserver
 	// asked about a name timed out, failed or returned a referral,
 	// so whether the name has addresses is unknown.

internal/resolver/export_test.go

@@ -17,43 +17,6 @@ func NewWithFailingTCP(log *slog.Logger) *Resolver {
 	return r
 }
 
-// NewWithQueryTimeout returns a Resolver whose queries over UDP give up
-// after timeout, so a test that asks an address where nothing answers
-// does not wait out the usual timeout.
-func NewWithQueryTimeout(log *slog.Logger, timeout time.Duration) *Resolver {
-	r := NewFromLogger(log)
-	r.client = &udpClient{timeout: timeout}
-
-	return r
-}
-
-// FollowDelegation exports followDelegation for testing.
-func (r *Resolver) FollowDelegation(
-	ctx context.Context,
-	domain string,
-	servers []string,
-) ([]string, error) {
-	return r.followDelegation(ctx, domain, servers)
-}
-
-// FindAuthoritativeNameserversFrom exports findAuthoritativeNameservers
-// for testing.
-func (r *Resolver) FindAuthoritativeNameserversFrom(
-	ctx context.Context,
-	domain string,
-	servers []string,
-) ([]string, error) {
-	return r.findAuthoritativeNameservers(ctx, domain, servers)
-}
-
-// ResolveNSIterative exports resolveNSIterative for testing.
-func (r *Resolver) ResolveNSIterative(
-	ctx context.Context,
-	domain string,
-) ([]string, error) {
-	return r.resolveNSIterative(ctx, domain)
-}
-
 // ExtractRecordValue exports extractRecordValue for testing.
 func ExtractRecordValue(rr dns.RR) string {
 	return extractRecordValue(rr)

internal/resolver/iterative.go

@@ -206,10 +206,9 @@ func glueIPs(nsNames []string, glue map[string][]net.IP) []string {
 
 // followDelegation follows referrals from servers, the root servers, to
 // domain and returns the NS set of domain's delegation. When the servers
-// of the zone domain is in answer that domain does not exist, the error
-// is ErrNXDomain. When they answer that it has no delegation of its own,
-// because it is not the zone's apex, the set is empty and there is no
-// error. Any other error means that no such answer came.
+// of the zone domain is in answer that it has no delegation of its own,
+// because it is not the zone's apex or does not exist, the set is empty
+// and there is no error. An error means that no such answer came.
 func (r *Resolver) followDelegation(
 	ctx context.Context,
 	domain string,
@@ -240,13 +239,8 @@ func (r *Resolver) followDelegation(
 		// An authoritative reply comes from the servers of the zone
 		// domain is in; it is not a referral, even when its authority
 		// section lists that zone's NS records. Without NS records in
-		// the answer, domain has no nameservers of its own: it does
-		// not exist, when the reply is NXDOMAIN, or else it is not the
-		// zone's apex.
-		if resp.Authoritative && resp.Rcode == dns.RcodeNameError {
-			return nil, ErrNXDomain
-		}
-
+		// the answer, domain is not the zone's apex, or does not
+		// exist, and has no nameservers of its own.
 		if resp.Authoritative {
 			return []string{}, nil
 		}
@@ -530,10 +524,6 @@ func (r *Resolver) resolveNSIterative(
 
 		// As in followDelegation: domain has no nameservers of its
 		// own.
-		if resp.Authoritative && resp.Rcode == dns.RcodeNameError {
-			return nil, ErrNXDomain
-		}
-
 		if resp.Authoritative {
 			return []string{}, nil
 		}
@@ -624,22 +614,12 @@ func (r *Resolver) resolveARecord(
 // root servers to discover all authoritative nameservers for the
 // given domain, as the delegation from its parent zone's servers lists
 // them. When the servers asked answer that the name has no delegation
-// of its own, or does not exist, it tries each parent name in turn, so
-// it returns the nameservers of the zone the name is in. When they do
-// not answer, it returns the error and tries no parent name.
+// of its own, it tries each parent name in turn, so it returns the
+// nameservers of the zone the name is in. When they do not answer, it
+// returns the error and tries no parent name.
 func (r *Resolver) FindAuthoritativeNameservers(
 	ctx context.Context,
 	domain string,
-) ([]string, error) {
-	return r.findAuthoritativeNameservers(ctx, domain, rootServerList())
-}
-
-// findAuthoritativeNameservers is FindAuthoritativeNameservers with each
-// walk starting at servers, the root servers.
-func (r *Resolver) findAuthoritativeNameservers(
-	ctx context.Context,
-	domain string,
-	servers []string,
 ) ([]string, error) {
 	if checkCtx(ctx) != nil {
 		return nil, ErrContextCanceled
@@ -655,8 +635,10 @@ func (r *Resolver) findAuthoritativeNameservers(
 
 		candidate := strings.Join(labels[i:], ".") + "."
 
-		nsNames, err := r.followDelegation(ctx, candidate, servers)
-		if err != nil && !errors.Is(err, ErrNXDomain) {
+		nsNames, err := r.followDelegation(
+			ctx, candidate, rootServerList(),
+		)
+		if err != nil {
 			return nil, err
 		}
 
@@ -941,9 +923,7 @@ func isTimeout(err error) bool {
 
 // classifyResponse sets the nameserver's status. One that answered no
 // record type has failed, and Error says why; one that answered some has
-// the status of those answers. It has no data only when every type
-// answered with no records: a type in FailedTypes may have records, so a
-// nameserver with one stays ok.
+// the status of those answers.
 func classifyResponse(resp *NameserverResponse, state queryState) {
 	switch {
 	case state.gotNXDomain && !state.hasRecords:
@@ -963,8 +943,7 @@ func classifyResponse(resp *NameserverResponse, state queryState) {
 	case state.gotReferral && !state.answered:
 		resp.Status = StatusError
 		resp.Error = "server returned a referral"
-	// An NXDOMAIN reply with no records was taken by the first case.
-	case !state.hasRecords && len(resp.FailedTypes) == 0:
+	case !state.hasRecords && !state.gotNXDomain:
 		resp.Status = StatusNoData
 	}
 }
@@ -1055,9 +1034,8 @@ func (r *Resolver) queryEachNS(
 
 // LookupNS returns the NS record set of a domain, as the delegation from
 // its parent zone's servers lists it, and never a parent name's. When
-// they answer that the domain does not exist, the error is ErrNXDomain.
-// When they answer that it has no delegation of its own, the set is
-// empty and there is no error.
+// they answer that the domain has no delegation of its own, as when it
+// does not exist, the set is empty and there is no error.
 func (r *Resolver) LookupNS(
 	ctx context.Context,
 	domain string,

internal/resolver/iterative_internal_test.go

@@ -11,77 +11,60 @@ import (
 )
 
 // TestClassifyResponse sets a nameserver's status from the results of
-// its queries and the record types whose query failed, built here. One
-// that answered some record types, even with no records, has not failed
-// when its query for another type got no usable reply, whatever the
-// reason, and is ok, not nodata: that type may have records. One whose
-// every query got none has failed. Only one whose every type answered
-// with no records is nodata.
+// its queries, built here. One that answered some record types, even
+// with no records, has not failed when its query for another type got
+// no usable reply, whatever the reason; one whose every query got none
+// has.
 func TestClassifyResponse(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
-		name        string
-		results     queryState
-		failedTypes []string
-		wantStatus  string
-		wantError   string
+		name       string
+		results    queryState
+		wantStatus string
+		wantError  string
 	}{
-		{
-			"every type answered with no records",
-			queryState{answered: true},
-			nil,
-			StatusNoData, "",
-		},
 		{
 			"some types answered with no records, another timed out",
 			queryState{answered: true, gotTimeout: true},
-			[]string{"A"},
-			StatusOK, "",
+			StatusNoData, "",
 		},
 		{
 			"some types answered with no records, another got SERVFAIL",
 			queryState{
 				answered: true, gotErrorReply: true, errorReply: "SERVFAIL",
 			},
-			[]string{"A"},
-			StatusOK, "",
+			StatusNoData, "",
 		},
 		{
 			"some types answered with no records, another was refused",
 			queryState{answered: true, gotRefused: true},
-			[]string{"A"},
-			StatusOK, "",
+			StatusNoData, "",
 		},
 		{
 			"some types answered with no records, another got a network error",
 			queryState{answered: true, netErr: syscall.ECONNREFUSED},
-			[]string{"A"},
-			StatusOK, "",
+			StatusNoData, "",
 		},
 		{
 			"some types answered with no records, another's reply was " +
 				"truncated and its retry over TCP failed",
 			queryState{answered: true, netErr: ErrTruncated},
-			[]string{"TXT"},
-			StatusOK, "",
+			StatusNoData, "",
 		},
 		{
 			"some types answered with no records, another got a referral",
 			queryState{answered: true, gotReferral: true},
-			[]string{"A"},
-			StatusOK, "",
+			StatusNoData, "",
 		},
 		{
 			"every query timed out",
 			queryState{gotTimeout: true},
-			[]string{"A", "AAAA", "CNAME"},
 			StatusTimeout, "all queries timed out",
 		},
 		{
 			"every query got NOTIMP",
 			queryState{gotErrorReply: true, errorReply: "NOTIMP"},
-			[]string{"A", "AAAA", "CNAME"},
 			StatusError, "server returned NOTIMP",
 		},
 	}
@@ -90,12 +73,11 @@ func TestClassifyResponse(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			resp := &NameserverResponse{Status: StatusOK, FailedTypes: tt.failedTypes}
+			resp := &NameserverResponse{Status: StatusOK}
 			classifyResponse(resp, tt.results)
 
 			assert.Equal(t, tt.wantStatus, resp.Status)
 			assert.Equal(t, tt.wantError, resp.Error)
-			assert.Equal(t, tt.failedTypes, resp.FailedTypes)
 		})
 	}
 }

internal/resolver/resolver_test.go

@@ -25,13 +25,6 @@ import (
 // Test helpers
 // ----------------------------------------------------------------
 
-// nonexistentDomain is a .com domain that does not exist.
-const nonexistentDomain = "dnswatcher-test-does-not-exist.com"
-
-// noAnswerAddress is 192.0.2.1, a documentation address: nothing
-// answers there.
-const noAnswerAddress = "192.0.2.1"
-
 func newTestResolver(t *testing.T) *resolver.Resolver {
 	t.Helper()
 
@@ -115,27 +108,6 @@ func TestFindAuthoritativeNameservers_DelegatedSubdomain(
 	assert.NotEqual(t, fromParent, fromHost)
 }
 
-// TestFindAuthoritativeNameservers_NoAnswer starts each walk for
-// www.google.com at 192.0.2.1, a documentation address where nothing
-// answers. A walk that got no answer does not say that the name has no
-// delegation of its own, so the lookup returns that walk's error, about
-// www.google.com, and tries no parent name: trying google.com and com
-// would end in ErrNoNameservers, or in the error of a walk for one of
-// them.
-func TestFindAuthoritativeNameservers_NoAnswer(t *testing.T) {
-	t.Parallel()
-
-	r := resolver.NewWithQueryTimeout(slog.Default(), 100*time.Millisecond)
-
-	nameservers, err := r.FindAuthoritativeNameserversFrom(
-		t.Context(), "www.google.com", []string{noAnswerAddress},
-	)
-	require.Error(t, err)
-	require.NotErrorIs(t, err, resolver.ErrNoNameservers)
-	assert.Contains(t, err.Error(), "query www.google.com. @"+noAnswerAddress)
-	assert.Empty(t, nameservers)
-}
-
 func TestFindAuthoritativeNameservers_ReturnsSorted(
 	t *testing.T,
 ) {
@@ -490,45 +462,48 @@ func TestQueryNameserver_Refused(t *testing.T) {
 	assert.Equal(t, "server returned REFUSED", resp.Error)
 }
 
-// TestQueryServers_RecursiveResolverRefused passes a public recursive
-// resolver to QueryServers as the server of google.com. These resolvers
-// refuse a query that does not ask for recursion and answer one that
-// does. The resolver never asks for recursion, so the query must be
-// reported as refused, never answered. Each resolver is run by a
-// different operator, and they are asked in turn until one replies, so
-// one operator not answering does not fail the test.
-func TestQueryServers_RecursiveResolverRefused(t *testing.T) {
+// TestQueryNameserverIP_RecursiveResolverRefused asks Quad9, a public
+// recursive resolver, about google.com at both of its addresses. Quad9
+// refuses a query that does not ask for recursion and answers one that
+// does. The resolver never asks for recursion, so it must be reported
+// as refusing, never as answering.
+func TestQueryNameserverIP_RecursiveResolverRefused(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	resolvers := []string{
-		"64.6.64.6", "185.222.222.222", "4.2.2.1", "9.9.9.9",
-	}
 
-	var err error
+	for _, ip := range []string{"9.9.9.9", "149.112.112.112"} {
+		var resp *resolver.NameserverResponse
 
-	livednstest.Retry(
-		t,
-		"QueryServers(public recursive resolvers, google.com)",
-		func(ctx context.Context) error {
-			for _, ip := range resolvers {
-				_, err = r.QueryServers(
-					ctx, []string{ip}, "google.com.", "google.com.",
-					dns.TypeA,
+		livednstest.Retry(
+			t,
+			"QueryNameserverIP("+ip+", google.com)",
+			func(ctx context.Context) error {
+				var err error
+
+				resp, err = r.QueryNameserverIP(
+					ctx, ip, ip, "google.com",
 				)
-
-				// A refusal or an answer is a reply; anything else may
-				// be no reply at all, so the next resolver is asked.
-				if err == nil || errors.Is(err, resolver.ErrRefused) {
-					return nil
+				if err != nil {
+					return err
 				}
-			}
 
-			return fmt.Errorf("%w: %w", livednstest.ErrNoAnswer, err)
-		},
-	)
+				// A timeout or a network error is no reply at all.
+				if resp.Status == resolver.StatusTimeout ||
+					strings.HasPrefix(resp.Error, "network error") {
+					return fmt.Errorf(
+						"%w: %s: %s",
+						livednstest.ErrNoAnswer, ip, resp.Error,
+					)
+				}
 
-	require.ErrorIs(t, err, resolver.ErrRefused)
+				return nil
+			},
+		)
+
+		assert.Equal(t, resolver.StatusError, resp.Status, ip)
+		assert.Equal(t, "server returned REFUSED", resp.Error, ip)
+	}
 }
 
 // googleNameserverIPv4s returns the IPv4 addresses of google.com's
@@ -887,42 +862,12 @@ func TestLookupNS_ParentZoneDelegatedWithoutAddresses(t *testing.T) {
 }
 
 // TestLookupNS_DomainThatDoesNotExist looks up the nameservers of a .com
-// domain that does not exist. The .com servers answer NXDOMAIN, so the
-// error is ErrNXDomain, and the domain does not get their names.
+// domain that does not exist. The .com servers answer that it does not
+// exist, so it has none, and does not get theirs.
 func TestLookupNS_DomainThatDoesNotExist(t *testing.T) {
 	t.Parallel()
 
-	r := newTestResolver(t)
-
-	var (
-		nameservers []string
-		err         error
-	)
-
-	livednstest.Retry(
-		t,
-		"LookupNS("+nonexistentDomain+")",
-		func(ctx context.Context) error {
-			nameservers, err = r.LookupNS(ctx, nonexistentDomain)
-			if errors.Is(err, resolver.ErrNXDomain) {
-				return nil
-			}
-
-			return err
-		},
-	)
-
-	require.ErrorIs(t, err, resolver.ErrNXDomain)
-	assert.Empty(t, nameservers)
-}
-
-// TestLookupNS_NoDelegationOfItsOwn looks up the nameservers of
-// www.google.com, a name in the google.com zone with no delegation of
-// its own, as a domain such as octocat.github.io is. The google.com
-// servers answer with no NS records for it: the set is empty, and it is
-// not ErrNXDomain.
-func TestLookupNS_NoDelegationOfItsOwn(t *testing.T) {
-	t.Parallel()
+	const domain = "dnswatcher-test-does-not-exist.com"
 
 	r := newTestResolver(t)
 
@@ -930,11 +875,11 @@ func TestLookupNS_NoDelegationOfItsOwn(t *testing.T) {
 
 	livednstest.Retry(
 		t,
-		"LookupNS(www.google.com)",
+		"LookupNS("+domain+")",
 		func(ctx context.Context) error {
 			var err error
 
-			nameservers, err = r.LookupNS(ctx, "www.google.com")
+			nameservers, err = r.LookupNS(ctx, domain)
 
 			return err
 		},
@@ -943,74 +888,6 @@ func TestLookupNS_NoDelegationOfItsOwn(t *testing.T) {
 	assert.Empty(t, nameservers)
 }
 
-// TestFollowDelegation_NoAnswer starts the walk LookupNS uses, for
-// google.com, at 192.0.2.1, a documentation address where nothing
-// answers. A walk that got no answer is an error, not an empty set,
-// which the watcher would report as an NS Change with every nameserver
-// removed.
-func TestFollowDelegation_NoAnswer(t *testing.T) {
-	t.Parallel()
-
-	r := resolver.NewWithQueryTimeout(slog.Default(), 100*time.Millisecond)
-
-	nameservers, err := r.FollowDelegation(
-		t.Context(), "google.com.", []string{noAnswerAddress},
-	)
-	require.Error(t, err)
-	assert.Empty(t, nameservers)
-}
-
-// TestResolveNSIterative_NoDelegationOfItsOwn walks to the nameservers
-// of www.google.com as the fallback walk does. As in
-// TestLookupNS_NoDelegationOfItsOwn, the set is empty, with no error.
-func TestResolveNSIterative_NoDelegationOfItsOwn(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-
-	var nameservers []string
-
-	livednstest.Retry(
-		t,
-		"ResolveNSIterative(www.google.com)",
-		func(ctx context.Context) error {
-			var err error
-
-			nameservers, err = r.ResolveNSIterative(ctx, "www.google.com")
-
-			return err
-		},
-	)
-
-	assert.Empty(t, nameservers)
-}
-
-// TestResolveNSIterative_DomainThatDoesNotExist walks to the nameservers
-// of a .com domain that does not exist as the fallback walk does. As in
-// TestLookupNS_DomainThatDoesNotExist, the error is ErrNXDomain.
-func TestResolveNSIterative_DomainThatDoesNotExist(t *testing.T) {
-	t.Parallel()
-
-	r := newTestResolver(t)
-
-	var err error
-
-	livednstest.Retry(
-		t,
-		"ResolveNSIterative("+nonexistentDomain+")",
-		func(ctx context.Context) error {
-			_, err = r.ResolveNSIterative(ctx, nonexistentDomain)
-			if errors.Is(err, resolver.ErrNXDomain) {
-				return nil
-			}
-
-			return err
-		},
-	)
-
-	require.ErrorIs(t, err, resolver.ErrNXDomain)
-}
-
 // ----------------------------------------------------------------
 // ResolveIPAddresses tests
 // ----------------------------------------------------------------

internal/state/state.go

@@ -38,13 +38,10 @@ type Params struct {
 // DomainState holds the monitoring state for an apex domain.
 // NameserverAddresses holds the sorted addresses each nameserver's name
 // resolves to, by nameserver name. A state file written before it
-// existed loads with it nil. NXDomain is true when the domain's parent
-// zone's servers answered that it does not exist; it then has no
-// nameservers.
+// existed loads with it nil.
 type DomainState struct {
 	Nameservers         []string            `json:"nameservers"`
 	NameserverAddresses map[string][]string `json:"nameserverAddresses"`
-	NXDomain            bool                `json:"nxdomain,omitempty"`
 	LastChecked         time.Time           `json:"lastChecked"`
 }
 

internal/watcher/interfaces.go

@@ -12,8 +12,7 @@ import (
 // DNSResolver performs iterative DNS resolution.
 type DNSResolver interface {
 	// LookupNS returns a domain's NS record set, as its parent zone's
-	// servers delegate it: empty when they answer that it has none, and
-	// resolver.ErrNXDomain when they answer that it does not exist.
+	// servers delegate it: empty when they answer that it has none.
 	LookupNS(
 		ctx context.Context,
 		domain string,

internal/watcher/watcher.go

@@ -289,13 +289,6 @@ func (w *Watcher) checkDomain(
 	domain string,
 ) {
 	nameservers, err := w.resolver.LookupNS(ctx, domain)
-
-	// A domain that does not exist has no nameservers.
-	nxdomain := errors.Is(err, resolver.ErrNXDomain)
-	if nxdomain {
-		nameservers, err = []string{}, nil
-	}
-
 	if err != nil {
 		w.logFailedLookup(
 			ctx,
@@ -330,18 +323,9 @@ func (w *Watcher) checkDomain(
 	w.state.SetDomainState(domain, &state.DomainState{
 		Nameservers:         nameservers,
 		NameserverAddresses: addresses,
-		NXDomain:            nxdomain,
 		LastChecked:         now,
 	})
 
-	// A domain that does not exist has no records of its own: none are
-	// asked for, and those saved by an earlier check are removed.
-	if nxdomain {
-		w.state.DeleteHostnameState(domain)
-
-		return
-	}
-
 	// The apex domain's records are also checked and saved as a
 	// hostname's, so that the port and TLS checks find its addresses.
 	// Notifications about them name it as a domain (see nameLine).

internal/watcher/watcher_test.go

@@ -482,119 +482,6 @@ func TestNSChangeDetection(t *testing.T) {
 	}
 }
 
-// TestDomainThatDoesNotExist checks a .com domain that does not exist,
-// with nameservers and records saved by an earlier check. The .com
-// servers answer that it does not exist, so it is saved with nxdomain
-// set and no nameservers, an NS Change removes them all, and its saved
-// records are removed rather than asked for at the .com servers.
-func TestDomainThatDoesNotExist(t *testing.T) {
-	t.Parallel()
-
-	const domain = "dnswatcher-test-does-not-exist.com"
-
-	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{domain}
-
-	var deps *testDeps
-
-	livednstest.Retry(t, "watcher checks", func(ctx context.Context) error {
-		var w *watcher.Watcher
-
-		w, deps = newTestWatcher(t, cfg)
-
-		deps.state.SetDomainState(domain, &state.DomainState{
-			Nameservers: []string{oldNS1, oldNS2},
-		})
-		deps.state.SetHostnameState(domain, &state.HostnameState{
-			RecordsByNameserver: map[string]*state.NameserverRecordState{
-				oldNS1: {
-					Records: map[string][]string{"A": {oldIP}},
-					Status:  "ok",
-				},
-			},
-		})
-
-		started := time.Now()
-
-		w.RunOnce(ctx)
-
-		// When no server answered, the domain's state is not saved.
-		ds, _ := deps.state.GetDomainState(domain)
-		if ds.LastChecked.Before(started) {
-			return fmt.Errorf("%s: %w", domain, livednstest.ErrNoAnswer)
-		}
-
-		return nil
-	})
-
-	ds, _ := deps.state.GetDomainState(domain)
-	if !ds.NXDomain || len(ds.Nameservers) != 0 {
-		t.Errorf("saved nxdomain %v and nameservers %v, want true and none",
-			ds.NXDomain, ds.Nameservers)
-	}
-
-	if hs, ok := deps.state.GetHostnameState(domain); ok {
-		t.Errorf("records saved for %s: %v", domain, hs.RecordsByNameserver)
-	}
-
-	assertNotified(t, deps, "NS Change: "+domain, "warning")
-
-	// That is the only notification, and it removes both nameservers,
-	// in either order.
-	for _, n := range deps.notifier.getNotifications() {
-		removed := strings.TrimPrefix(
-			n.Message, "Domain: "+domain+"\nAdded: \nRemoved: ",
-		)
-		if removed != oldNS1+", "+oldNS2 && removed != oldNS2+", "+oldNS1 {
-			t.Errorf("unexpected notification: %v", n)
-		}
-	}
-}
-
-// TestDomainWithNoDelegationOfItsOwn checks a domain with no delegation
-// of its own: codeberg.page is on the public suffix list, so
-// docs.codeberg.page is a domain, but the .page servers delegate only
-// codeberg.page, whose servers answer for it. It is saved with no
-// nameservers and without nxdomain, and its records, asked at the
-// codeberg.page servers, are saved. Those are testSmallDomain's two
-// nameservers; github.io, the zone of the README's example, has eight.
-func TestDomainWithNoDelegationOfItsOwn(t *testing.T) {
-	t.Parallel()
-
-	const domain = "docs.codeberg.page"
-
-	cfg := defaultTestConfig(t)
-	cfg.Domains = []string{domain}
-
-	var deps *testDeps
-
-	livednstest.Retry(t, "watcher checks", func(ctx context.Context) error {
-		var w *watcher.Watcher
-
-		w, deps = newTestWatcher(t, cfg)
-
-		err := checkOnce(ctx, w, deps)
-
-		// A domain saved as not existing has no records to wait for;
-		// the checks below fail on it.
-		if ds, ok := deps.state.GetDomainState(domain); ok && ds.NXDomain {
-			return nil
-		}
-
-		return err
-	})
-
-	ds, _ := deps.state.GetDomainState(domain)
-	if ds.NXDomain || len(ds.Nameservers) != 0 {
-		t.Errorf("saved nxdomain %v and nameservers %v, want false and none",
-			ds.NXDomain, ds.Nameservers)
-	}
-
-	if _, ok := deps.state.GetHostnameState(domain); !ok {
-		t.Errorf("no records saved for %s", domain)
-	}
-}
-
 func TestNSAddressChangeDetection(t *testing.T) {
 	t.Parallel()