ResolveIPAddresses returns no addresses and no error when every nameserver fails #190

New Issue

2026-10-01T22:54:12+02:00

clawbot commented

2026-10-01 22:54:12 +02:00

Found while reviewing #187.

ResolveIPAddresses in internal/resolver/iterative.go reads only the records from each nameserver's answer and ignores its status. When every nameserver of the name's zone times out, fails or refuses, it returns no addresses and no error, which callers cannot tell apart from a name that has no addresses. It does return an error when the walk down from the root fails.

Definition of done

When no nameserver of the zone gave a usable answer, ResolveIPAddresses returns an error saying so; a name that really has no addresses still returns none and no error.
Callers (port and TLS checks, nameserver addresses) keep their previous state on that error rather than recording "no addresses", and say so in a test or in the PR where a test cannot be reliable.
Live-DNS test for the error case against servers that never answer (for example a documentation address), as the resolver timeout test does. No stand-in resolver.

Model: opus-5-5

Found while reviewing https://git.eeqj.de/sneak/dnswatcher/pulls/187. `ResolveIPAddresses` in `internal/resolver/iterative.go` reads only the records from each nameserver's answer and ignores its status. When every nameserver of the name's zone times out, fails or refuses, it returns no addresses and no error, which callers cannot tell apart from a name that has no addresses. It does return an error when the walk down from the root fails. ## Definition of done - When no nameserver of the zone gave a usable answer, `ResolveIPAddresses` returns an error saying so; a name that really has no addresses still returns none and no error. - Callers (port and TLS checks, nameserver addresses) keep their previous state on that error rather than recording "no addresses", and say so in a test or in the PR where a test cannot be reliable. - Live-DNS test for the error case against servers that never answer (for example a documentation address), as the resolver timeout test does. No stand-in resolver. Model: opus-5-5

clawbot added this to the 1.0 milestone 2026-10-01 22:54:12 +02:00

clawbot referenced this issue from a commit

2026-10-01 23:43:56 +02:00

resolver: error from ResolveIPAddresses when no nameserver answered (closes #190)

clawbot referenced this issue

2026-10-01 23:44:13 +02:00

Saved port state is removed when every nameserver of a hostname fails #193

clawbot referenced a pull request that will close this issue

2026-10-01 23:44:29 +02:00

resolver: error from ResolveIPAddresses when no nameserver answered (closes #190) #194

clawbot commented

2026-10-01 23:44:37 +02:00

Done in #194. The port and TLS checks do not call ResolveIPAddresses, so the port-state loss they have when every nameserver fails is filed separately as #193.

Model: opus-5-5

Done in https://git.eeqj.de/sneak/dnswatcher/pulls/194. The port and TLS checks do not call `ResolveIPAddresses`, so the port-state loss they have when every nameserver fails is filed separately as https://git.eeqj.de/sneak/dnswatcher/issues/193. Model: opus-5-5

clawbot referenced this issue

2026-10-02 00:02:43 +02:00

resolver: error from ResolveIPAddresses when no nameserver answered (closes #190) #194

clawbot referenced this issue from a commit

2026-10-02 00:11:48 +02:00

resolver: error from ResolveIPAddresses when no nameserver answered (closes #190)

clawbot referenced this issue

2026-10-02 00:26:25 +02:00

Finding a zone's servers gives up after the first server answers SERVFAIL or refers onward #197

clawbot referenced this issue from a commit

2026-10-02 00:28:20 +02:00

resolver: error from ResolveIPAddresses when no nameserver answered (closes #190)