32.25 === CONT TestFailedTypeComparedOnceItAnswers/change_seen_at_one_nameserver_while_the_other's_type_failed
32.25 --- PASS: TestFailedTypeComparedOnceItAnswers (0.00s)
32.25 --- PASS: TestFailedTypeComparedOnceItAnswers/change_made_while_the_type_failed (0.00s)
32.25 --- PASS: TestFailedTypeComparedOnceItAnswers/change_after_the_type_failed_on_the_first_check_and_answered (0.00s)
32.25 --- PASS: TestFailedTypeComparedOnceItAnswers/old_record_answered_after_the_type_failed (0.00s)
32.25 --- PASS: TestFailedTypeComparedOnceItAnswers/change_seen_at_one_nameserver_while_the_other's_type_failed (0.00s)
32.25 2026/10/16 07:19:46 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @192.112.36.4: reply is an error or a referral that leads no closer"
32.25 === NAME TestDomainPortAndTLSChecks
32.25 watcher_test.go:448: watcher checks: all 3 live attempts failed: desec.io: no answer from live DNS, or the watcher saved no fresh result for it
32.25 --- FAIL: TestDomainPortAndTLSChecks (3.28s)
32.25 {"time":"2026-10-16T07:19:46.382072343Z","level":"INFO","source":{"function":"sneak.berlin/go/dnswatcher/internal/state.(*State).Load","file":"/src/internal/state/state.go","line":251},"msg":"loaded state from disk","path":"/tmp/TestFirstCheckAfterLoadingFileWithoutSectionsno_sections3306988037/001/state.json"}
32.25 2026/10/16 07:19:46 ERROR failed to lookup NS domain=docs.codeberg.page error="all servers failed: query docs.codeberg.page. @192.203.230.10: reply is an error or a referral that leads no closer"
32.25 2026/10/16 07:19:46 ERROR failed to follow CNAME hostname=www.example.net target=one.one.one.one. error="all servers failed: query one.one.one.one. @192.112.36.4: reply is an error or a referral that leads no closer"
32.25 === NAME TestCNAMEAddressesOfEveryTarget
32.25 cname_test.go:133: following CNAMEs: attempt 1 of 3 failed (no answer from live DNS), retrying in 500ms
32.25 2026/10/16 07:19:46 ERROR no addresses found for nameserver nameserver=this-surely-does-not-exist-xyz.desec.io. error="all servers failed: query this-surely-does-not-exist-xyz.desec.io. @192.33.4.12: reply is an error or a referral that leads no closer"
32.25 --- PASS: TestNameserverWithNoAddressKeepsPrevious (0.96s)
32.25 2026/10/16 07:19:46 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @202.12.27.33: reply is an error or a referral that leads no closer"
32.25 === NAME TestFirstCheckAfterLoadingFileWithoutSections/no_certificates
32.25 watcher_test.go:503: watcher checks: attempt 1 of 3 failed (desec.io: no answer from live DNS, or the watcher saved no fresh result for it), retrying in 500ms
32.25 2026/10/16 07:19:46 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @192.112.36.4: reply is an error or a referral that leads no closer"
32.25 === NAME TestFirstCheckAfterLoadingFileWithoutSections/no_sections
32.25 watcher_test.go:503: watcher checks: attempt 1 of 3 failed (desec.io: no answer from live DNS, or the watcher saved no fresh result for it), retrying in 500ms
32.25 === NAME TestNameserverThatRefuses
32.25 nsfailure_test.go:420: QueryNameserver(cloudflare.com): attempt 2 of 3 failed (resolving NS ns1.google.com.: resolving ns1.google.com.: all servers failed: query ns1.google.com. @216.239.36.10: reply is an error or a referral that leads no closer), retrying in 1s
32.25 === NAME TestNameserverThatAnswersNXDOMAIN
32.25 nsfailure_test.go:363: QueryNameserver(this-surely-does-not-exist-xyz.google.com): attempt 2 of 3 failed (resolving NS ns1.google.com.: resolving ns1.google.com.: all servers failed: query ns1.google.com. @216.239.38.10: reply is an error or a referral that leads no closer), retrying in 1s
32.25 2026/10/16 07:19:47 ERROR failed to lookup NS domain=docs.codeberg.page error="all servers failed: query docs.codeberg.page. @192.203.230.10: reply is an error or a referral that leads no closer"
32.25 === NAME TestDomainWithNoDelegationOfItsOwn
32.25 watcher_test.go:641: watcher checks: all 3 live attempts failed: docs.codeberg.page: no answer from live DNS, or the watcher saved no fresh result for it
32.25 --- FAIL: TestDomainWithNoDelegationOfItsOwn (4.56s)
32.25 === NAME TestSkipRecordNotificationsCheck
32.25 skiprecordnotifications_test.go:79: LookupNS(example.org): attempt 2 of 3 failed (all servers failed: query example.org. @202.12.27.33: reply is an error or a referral that leads no closer), retrying in 1s
32.25 {"time":"2026-10-16T07:19:47.268462489Z","level":"INFO","source":{"function":"sneak.berlin/go/dnswatcher/internal/state.(*State).Load","file":"/src/internal/state/state.go","line":251},"msg":"loaded state from disk","path":"/tmp/TestFirstCheckAfterLoadingFileWithoutSectionsno_certificates378052059/001/state.json"}
32.25 {"time":"2026-10-16T07:19:47.280587698Z","level":"INFO","source":{"function":"sneak.berlin/go/dnswatcher/internal/state.(*State).Load","file":"/src/internal/state/state.go","line":251},"msg":"loaded state from disk","path":"/tmp/TestFirstCheckAfterLoadingFileWithoutSectionsno_sections3306988037/001/state.json"}
32.25 2026/10/16 07:19:47 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @193.0.14.129: reply is an error or a referral that leads no closer"
32.25 2026/10/16 07:19:47 ERROR failed to lookup NS domain=dnswatcher-test-does-not-exist.com error="no address for any nameserver of com.: no authoritative nameservers found"
32.25 === NAME TestDomainThatDoesNotExist
32.25 watcher_test.go:565: watcher checks: attempt 2 of 3 failed (dnswatcher-test-does-not-exist.com: no answer from live DNS), retrying in 1s
32.25 2026/10/16 07:19:47 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @198.41.0.4: reply is an error or a referral that leads no closer"
32.25 === NAME TestFirstCheckAfterLoadingFileWithoutSections/no_sections
32.25 watcher_test.go:503: watcher checks: attempt 2 of 3 failed (desec.io: no answer from live DNS, or the watcher saved no fresh result for it), retrying in 1s
32.25 2026/10/16 07:19:47 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @170.247.170.2: reply is an error or a referral that leads no closer"
32.25 2026/10/16 07:19:47 ERROR failed to lookup records hostname=example.org error="all servers failed: query example.org. @192.58.128.30: reply is an error or a referral that leads no closer"
32.25 === NAME TestFirstCheckAfterLoadingFileWithoutSections/no_certificates
32.25 watcher_test.go:503: watcher checks: attempt 2 of 3 failed (desec.io: no answer from live DNS, or the watcher saved no fresh result for it), retrying in 1s
32.25 === NAME TestFirstRunBaseline
32.25 watcher_test.go:388: watcher checks: attempt 2 of 3 failed (desec.io: no answer from live DNS, or the watcher saved no fresh result for it), retrying in 1s
32.25 2026/10/16 07:19:47 ERROR failed to follow CNAME hostname=www.example.net target=dns.adguard-dns.com. error="resolving dns.adguard-dns.com.: no nameserver answered"
32.25 === NAME TestCNAMEAddressesOfEveryTarget
32.25 cname_test.go:133: following CNAMEs: attempt 2 of 3 failed (no answer from live DNS), retrying in 1s
32.25 === NAME TestNameserverThatRefuses
32.25 nsfailure_test.go:420: QueryNameserver(cloudflare.com): all 3 live attempts failed: resolving NS ns1.google.com.: resolving ns1.google.com.: all servers failed: query ns1.google.com. @216.239.38.10: reply is an error or a referral that leads no closer
32.25 --- FAIL: TestNameserverThatRefuses (2.75s)
32.25 === NAME TestNameserverThatAnswersNXDOMAIN
32.25 nsfailure_test.go:363: QueryNameserver(this-surely-does-not-exist-xyz.google.com): all 3 live attempts failed: resolving NS ns1.google.com.: resolving ns1.google.com.: all servers failed: query ns1.google.com. @216.239.38.10: reply is an error or a referral that leads no closer
32.25 --- FAIL: TestNameserverThatAnswersNXDOMAIN (2.64s)
32.25 === NAME TestSkipRecordNotificationsCheck
32.25 skiprecordnotifications_test.go:79: LookupNS(example.org): all 3 live attempts failed: all servers failed: query example.org. @192.36.148.17: reply is an error or a referral that leads no closer
32.25 --- FAIL: TestSkipRecordNotificationsCheck (3.24s)
32.25 {"time":"2026-10-16T07:19:48.749885074Z","level":"INFO","source":{"function":"sneak.berlin/go/dnswatcher/internal/state.(*State).Load","file":"/src/internal/state/state.go","line":251},"msg":"loaded state from disk","path":"/tmp/TestFirstCheckAfterLoadingFileWithoutSectionsno_sections3306988037/001/state.json"}
32.25 {"time":"2026-10-16T07:19:48.750897757Z","level":"INFO","source":{"function":"sneak.berlin/go/dnswatcher/internal/state.(*State).Load","file":"/src/internal/state/state.go","line":251},"msg":"loaded state from disk","path":"/tmp/TestFirstCheckAfterLoadingFileWithoutSectionsno_certificates378052059/001/state.json"}
32.25 2026/10/16 07:19:49 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @199.7.91.13: reply is an error or a referral that leads no closer"
32.25 2026/10/16 07:19:49 ERROR failed to follow CNAME hostname=www.example.net target=one.one.one.one. error="all servers failed: query one.one.one.one. @192.36.148.17: reply is an error or a referral that leads no closer"
32.25 === NAME TestCNAMEAddressesOfEveryTarget
32.25 2026/10/16 07:19:49 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @192.58.128.30: reply is an error or a referral that leads no closer"
32.25 cname_test.go:133: following CNAMEs: all 3 live attempts failed: no answer from live DNS
32.25 --- FAIL: TestCNAMEAddressesOfEveryTarget (3.47s)
32.25 2026/10/16 07:19:49 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @192.33.4.12: reply is an error or a referral that leads no closer"
32.25 === NAME TestFirstCheckAfterLoadingFileWithoutSections/no_certificates
32.25 watcher_test.go:503: watcher checks: all 3 live attempts failed: desec.io: no answer from live DNS, or the watcher saved no fresh result for it
32.25 === NAME TestFirstCheckAfterLoadingFileWithoutSections/no_sections
32.25 watcher_test.go:503: watcher checks: all 3 live attempts failed: desec.io: no answer from live DNS, or the watcher saved no fresh result for it
32.25 --- FAIL: TestFirstCheckAfterLoadingFileWithoutSections (0.00s)
32.25 --- FAIL: TestFirstCheckAfterLoadingFileWithoutSections/no_certificates (3.25s)
32.25 --- FAIL: TestFirstCheckAfterLoadingFileWithoutSections/no_sections (3.17s)
32.25 2026/10/16 07:19:49 ERROR failed to lookup records hostname=example.org error="all servers failed: query example.org. @192.112.36.4: reply is an error or a referral that leads no closer"
32.25 === NAME TestFirstRunBaseline
32.25 watcher_test.go:388: watcher checks: all 3 live attempts failed: desec.io: no answer from live DNS, or the watcher saved no fresh result for it
32.25 --- FAIL: TestFirstRunBaseline (4.55s)
32.25 2026/10/16 07:19:50 ERROR failed to lookup NS domain=dnswatcher-test-does-not-exist.com error="no address for any nameserver of com.: no authoritative nameservers found"
32.25 === NAME TestDomainThatDoesNotExist
32.25 watcher_test.go:565: watcher checks: all 3 live attempts failed: dnswatcher-test-does-not-exist.com: no answer from live DNS
32.25 --- FAIL: TestDomainThatDoesNotExist (8.13s)
32.25 FAIL
32.25 FAIL sneak.berlin/go/dnswatcher/internal/watcher 8.163s
32.25 ? sneak.berlin/go/dnswatcher/static [no test files]
32.25 FAIL
------
Dockerfile:29
--------------------
28 | COPY . .
29 | >>> RUN go test -count=1 -race -timeout 90s -cover ./... || \
30 | >>> { echo "--- Rerunning with -v for details ---"; \
31 | >>> go test -count=1 -race -timeout 90s -v ./...; exit 1; }
32 |
--------------------
ERROR: failed to build: failed to solve: process "/bin/sh -c go test -count=1 -race -timeout 90s -cover ./... || { echo \"--- Rerunning with -v for details ---\"; go test -count=1 -race -timeout 90s -v ./...; exit 1; }" did not complete successfully: exit code: 1
make: *** [check] Error 1
user@heraklion:~/dev/dnswatcher$
```
32.25 === CONT TestFailedTypeComparedOnceItAnswers/change_seen_at_one_nameserver_while_the_other's_type_failed
32.25 --- PASS: TestFailedTypeComparedOnceItAnswers (0.00s)
32.25 --- PASS: TestFailedTypeComparedOnceItAnswers/change_made_while_the_type_failed (0.00s)
32.25 --- PASS: TestFailedTypeComparedOnceItAnswers/change_after_the_type_failed_on_the_first_check_and_answered (0.00s)
32.25 --- PASS: TestFailedTypeComparedOnceItAnswers/old_record_answered_after_the_type_failed (0.00s)
32.25 --- PASS: TestFailedTypeComparedOnceItAnswers/change_seen_at_one_nameserver_while_the_other's_type_failed (0.00s)
32.25 2026/10/16 07:19:46 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @192.112.36.4: reply is an error or a referral that leads no closer"
32.25 === NAME TestDomainPortAndTLSChecks
32.25 watcher_test.go:448: watcher checks: all 3 live attempts failed: desec.io: no answer from live DNS, or the watcher saved no fresh result for it
32.25 --- FAIL: TestDomainPortAndTLSChecks (3.28s)
32.25 {"time":"2026-10-16T07:19:46.382072343Z","level":"INFO","source":{"function":"sneak.berlin/go/dnswatcher/internal/state.(*State).Load","file":"/src/internal/state/state.go","line":251},"msg":"loaded state from disk","path":"/tmp/TestFirstCheckAfterLoadingFileWithoutSectionsno_sections3306988037/001/state.json"}
32.25 2026/10/16 07:19:46 ERROR failed to lookup NS domain=docs.codeberg.page error="all servers failed: query docs.codeberg.page. @192.203.230.10: reply is an error or a referral that leads no closer"
32.25 2026/10/16 07:19:46 ERROR failed to follow CNAME hostname=www.example.net target=one.one.one.one. error="all servers failed: query one.one.one.one. @192.112.36.4: reply is an error or a referral that leads no closer"
32.25 === NAME TestCNAMEAddressesOfEveryTarget
32.25 cname_test.go:133: following CNAMEs: attempt 1 of 3 failed (no answer from live DNS), retrying in 500ms
32.25 2026/10/16 07:19:46 ERROR no addresses found for nameserver nameserver=this-surely-does-not-exist-xyz.desec.io. error="all servers failed: query this-surely-does-not-exist-xyz.desec.io. @192.33.4.12: reply is an error or a referral that leads no closer"
32.25 --- PASS: TestNameserverWithNoAddressKeepsPrevious (0.96s)
32.25 2026/10/16 07:19:46 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @202.12.27.33: reply is an error or a referral that leads no closer"
32.25 === NAME TestFirstCheckAfterLoadingFileWithoutSections/no_certificates
32.25 watcher_test.go:503: watcher checks: attempt 1 of 3 failed (desec.io: no answer from live DNS, or the watcher saved no fresh result for it), retrying in 500ms
32.25 2026/10/16 07:19:46 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @192.112.36.4: reply is an error or a referral that leads no closer"
32.25 === NAME TestFirstCheckAfterLoadingFileWithoutSections/no_sections
32.25 watcher_test.go:503: watcher checks: attempt 1 of 3 failed (desec.io: no answer from live DNS, or the watcher saved no fresh result for it), retrying in 500ms
32.25 === NAME TestNameserverThatRefuses
32.25 nsfailure_test.go:420: QueryNameserver(cloudflare.com): attempt 2 of 3 failed (resolving NS ns1.google.com.: resolving ns1.google.com.: all servers failed: query ns1.google.com. @216.239.36.10: reply is an error or a referral that leads no closer), retrying in 1s
32.25 === NAME TestNameserverThatAnswersNXDOMAIN
32.25 nsfailure_test.go:363: QueryNameserver(this-surely-does-not-exist-xyz.google.com): attempt 2 of 3 failed (resolving NS ns1.google.com.: resolving ns1.google.com.: all servers failed: query ns1.google.com. @216.239.38.10: reply is an error or a referral that leads no closer), retrying in 1s
32.25 2026/10/16 07:19:47 ERROR failed to lookup NS domain=docs.codeberg.page error="all servers failed: query docs.codeberg.page. @192.203.230.10: reply is an error or a referral that leads no closer"
32.25 === NAME TestDomainWithNoDelegationOfItsOwn
32.25 watcher_test.go:641: watcher checks: all 3 live attempts failed: docs.codeberg.page: no answer from live DNS, or the watcher saved no fresh result for it
32.25 --- FAIL: TestDomainWithNoDelegationOfItsOwn (4.56s)
32.25 === NAME TestSkipRecordNotificationsCheck
32.25 skiprecordnotifications_test.go:79: LookupNS(example.org): attempt 2 of 3 failed (all servers failed: query example.org. @202.12.27.33: reply is an error or a referral that leads no closer), retrying in 1s
32.25 {"time":"2026-10-16T07:19:47.268462489Z","level":"INFO","source":{"function":"sneak.berlin/go/dnswatcher/internal/state.(*State).Load","file":"/src/internal/state/state.go","line":251},"msg":"loaded state from disk","path":"/tmp/TestFirstCheckAfterLoadingFileWithoutSectionsno_certificates378052059/001/state.json"}
32.25 {"time":"2026-10-16T07:19:47.280587698Z","level":"INFO","source":{"function":"sneak.berlin/go/dnswatcher/internal/state.(*State).Load","file":"/src/internal/state/state.go","line":251},"msg":"loaded state from disk","path":"/tmp/TestFirstCheckAfterLoadingFileWithoutSectionsno_sections3306988037/001/state.json"}
32.25 2026/10/16 07:19:47 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @193.0.14.129: reply is an error or a referral that leads no closer"
32.25 2026/10/16 07:19:47 ERROR failed to lookup NS domain=dnswatcher-test-does-not-exist.com error="no address for any nameserver of com.: no authoritative nameservers found"
32.25 === NAME TestDomainThatDoesNotExist
32.25 watcher_test.go:565: watcher checks: attempt 2 of 3 failed (dnswatcher-test-does-not-exist.com: no answer from live DNS), retrying in 1s
32.25 2026/10/16 07:19:47 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @198.41.0.4: reply is an error or a referral that leads no closer"
32.25 === NAME TestFirstCheckAfterLoadingFileWithoutSections/no_sections
32.25 watcher_test.go:503: watcher checks: attempt 2 of 3 failed (desec.io: no answer from live DNS, or the watcher saved no fresh result for it), retrying in 1s
32.25 2026/10/16 07:19:47 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @170.247.170.2: reply is an error or a referral that leads no closer"
32.25 2026/10/16 07:19:47 ERROR failed to lookup records hostname=example.org error="all servers failed: query example.org. @192.58.128.30: reply is an error or a referral that leads no closer"
32.25 === NAME TestFirstCheckAfterLoadingFileWithoutSections/no_certificates
32.25 watcher_test.go:503: watcher checks: attempt 2 of 3 failed (desec.io: no answer from live DNS, or the watcher saved no fresh result for it), retrying in 1s
32.25 === NAME TestFirstRunBaseline
32.25 watcher_test.go:388: watcher checks: attempt 2 of 3 failed (desec.io: no answer from live DNS, or the watcher saved no fresh result for it), retrying in 1s
32.25 2026/10/16 07:19:47 ERROR failed to follow CNAME hostname=www.example.net target=dns.adguard-dns.com. error="resolving dns.adguard-dns.com.: no nameserver answered"
32.25 === NAME TestCNAMEAddressesOfEveryTarget
32.25 cname_test.go:133: following CNAMEs: attempt 2 of 3 failed (no answer from live DNS), retrying in 1s
32.25 === NAME TestNameserverThatRefuses
32.25 nsfailure_test.go:420: QueryNameserver(cloudflare.com): all 3 live attempts failed: resolving NS ns1.google.com.: resolving ns1.google.com.: all servers failed: query ns1.google.com. @216.239.38.10: reply is an error or a referral that leads no closer
32.25 --- FAIL: TestNameserverThatRefuses (2.75s)
32.25 === NAME TestNameserverThatAnswersNXDOMAIN
32.25 nsfailure_test.go:363: QueryNameserver(this-surely-does-not-exist-xyz.google.com): all 3 live attempts failed: resolving NS ns1.google.com.: resolving ns1.google.com.: all servers failed: query ns1.google.com. @216.239.38.10: reply is an error or a referral that leads no closer
32.25 --- FAIL: TestNameserverThatAnswersNXDOMAIN (2.64s)
32.25 === NAME TestSkipRecordNotificationsCheck
32.25 skiprecordnotifications_test.go:79: LookupNS(example.org): all 3 live attempts failed: all servers failed: query example.org. @192.36.148.17: reply is an error or a referral that leads no closer
32.25 --- FAIL: TestSkipRecordNotificationsCheck (3.24s)
32.25 {"time":"2026-10-16T07:19:48.749885074Z","level":"INFO","source":{"function":"sneak.berlin/go/dnswatcher/internal/state.(*State).Load","file":"/src/internal/state/state.go","line":251},"msg":"loaded state from disk","path":"/tmp/TestFirstCheckAfterLoadingFileWithoutSectionsno_sections3306988037/001/state.json"}
32.25 {"time":"2026-10-16T07:19:48.750897757Z","level":"INFO","source":{"function":"sneak.berlin/go/dnswatcher/internal/state.(*State).Load","file":"/src/internal/state/state.go","line":251},"msg":"loaded state from disk","path":"/tmp/TestFirstCheckAfterLoadingFileWithoutSectionsno_certificates378052059/001/state.json"}
32.25 2026/10/16 07:19:49 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @199.7.91.13: reply is an error or a referral that leads no closer"
32.25 2026/10/16 07:19:49 ERROR failed to follow CNAME hostname=www.example.net target=one.one.one.one. error="all servers failed: query one.one.one.one. @192.36.148.17: reply is an error or a referral that leads no closer"
32.25 === NAME TestCNAMEAddressesOfEveryTarget
32.25 2026/10/16 07:19:49 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @192.58.128.30: reply is an error or a referral that leads no closer"
32.25 cname_test.go:133: following CNAMEs: all 3 live attempts failed: no answer from live DNS
32.25 --- FAIL: TestCNAMEAddressesOfEveryTarget (3.47s)
32.25 2026/10/16 07:19:49 ERROR failed to lookup NS domain=desec.io error="all servers failed: query desec.io. @192.33.4.12: reply is an error or a referral that leads no closer"
32.25 === NAME TestFirstCheckAfterLoadingFileWithoutSections/no_certificates
32.25 watcher_test.go:503: watcher checks: all 3 live attempts failed: desec.io: no answer from live DNS, or the watcher saved no fresh result for it
32.25 === NAME TestFirstCheckAfterLoadingFileWithoutSections/no_sections
32.25 watcher_test.go:503: watcher checks: all 3 live attempts failed: desec.io: no answer from live DNS, or the watcher saved no fresh result for it
32.25 --- FAIL: TestFirstCheckAfterLoadingFileWithoutSections (0.00s)
32.25 --- FAIL: TestFirstCheckAfterLoadingFileWithoutSections/no_certificates (3.25s)
32.25 --- FAIL: TestFirstCheckAfterLoadingFileWithoutSections/no_sections (3.17s)
32.25 2026/10/16 07:19:49 ERROR failed to lookup records hostname=example.org error="all servers failed: query example.org. @192.112.36.4: reply is an error or a referral that leads no closer"
32.25 === NAME TestFirstRunBaseline
32.25 watcher_test.go:388: watcher checks: all 3 live attempts failed: desec.io: no answer from live DNS, or the watcher saved no fresh result for it
32.25 --- FAIL: TestFirstRunBaseline (4.55s)
32.25 2026/10/16 07:19:50 ERROR failed to lookup NS domain=dnswatcher-test-does-not-exist.com error="no address for any nameserver of com.: no authoritative nameservers found"
32.25 === NAME TestDomainThatDoesNotExist
32.25 watcher_test.go:565: watcher checks: all 3 live attempts failed: dnswatcher-test-does-not-exist.com: no answer from live DNS
32.25 --- FAIL: TestDomainThatDoesNotExist (8.13s)
32.25 FAIL
32.25 FAIL sneak.berlin/go/dnswatcher/internal/watcher 8.163s
32.25 ? sneak.berlin/go/dnswatcher/static [no test files]
32.25 FAIL
------
Dockerfile:29
--------------------
28 | COPY . .
29 | >>> RUN go test -count=1 -race -timeout 90s -cover ./... || \
30 | >>> { echo "--- Rerunning with -v for details ---"; \
31 | >>> go test -count=1 -race -timeout 90s -v ./...; exit 1; }
32 |
--------------------
ERROR: failed to build: failed to solve: process "/bin/sh -c go test -count=1 -race -timeout 90s -cover ./... || { echo \"--- Rerunning with -v for details ---\"; go test -count=1 -race -timeout 90s -v ./...; exit 1; }" did not complete successfully: exit code: 1
make: *** [check] Error 1
user@heraklion:~/dev/dnswatcher$
```
script/cibuild on a fresh clone of next (adc8131) passes on this host.
Cause. Something on your network answers DNS queries sent to port 53 at any address itself, instead of passing them to the server they were sent to. This is usually a router rule that sends all DNS to one resolver, a VPN, or a DNS filter. dnswatcher asks the root servers and each domain's own nameservers directly, and it never asks for recursion. A recursive resolver that gets such a query answers only from its cache, and for a name it has not cached it replies with an error. That error is the "reply is an error or a referral that leads no closer" in your log. It also explains why names a resolver probably had cached, such as google.com, got further than desec.io or docs.codeberg.page. From here, 1.1.1.1, 8.8.8.8 and 9.9.9.9 answer these queries with SERVFAIL or REFUSED and mark their replies "recursion available". A real root server never does either. dnswatcher itself is affected the same way on such a network. It fails for names the resolver has not cached, and for names it has cached it reports the resolver's cached answer as if each nameserver had given it.
Fix, as one PR on next, in the resolver (internal/resolver):
A reply over UDP marked "recursion available" is asked again over TCP, and the TCP reply is used. Many networks redirect only UDP DNS.
A reply from a root server that is still marked "recursion available" cannot have come from a root server, so it is not used. When every root server either refused or gave such a reply, the error is the existing "this network intercepts DNS queries". Today that error covers only the case where every root server refuses.
Live tests, with no DNS mocked: several public recursive resolvers stand in for the root servers, the same way the existing interception tests use google.com's nameservers, and the result is that error. The README's DNS Resolution Strategy section says what happens on such a network.
Checked by hand, with nothing committed: the built image, run in a throwaway container whose outgoing UDP port 53 is redirected to a public resolver, fails as in your log before the change and resolves after it. With TCP redirected too, it reports the interception error.
This makes make check pass on a network that intercepts DNS over UDP only. If yours intercepts TCP as well, the tests and dnswatcher will fail with that clear message instead. The only change left after that would be to which tests run, and that would come back to you here as a question.
To find out which case you have (optional, nothing waits on it), run these on the machine where make check failed:
A real root server answers status: NOERROR with no ra in the flags: line. If you see ra or SERVFAIL, the answer came from your network instead. The second command shows whether that also happens over TCP.
Model: opus-5-5
`script/cibuild` on a fresh clone of `next` (`adc8131`) passes on this host.
**Cause.** Something on your network answers DNS queries sent to port 53 at any address itself, instead of passing them to the server they were sent to. This is usually a router rule that sends all DNS to one resolver, a VPN, or a DNS filter. dnswatcher asks the root servers and each domain's own nameservers directly, and it never asks for recursion. A recursive resolver that gets such a query answers only from its cache, and for a name it has not cached it replies with an error. That error is the "reply is an error or a referral that leads no closer" in your log. It also explains why names a resolver probably had cached, such as `google.com`, got further than `desec.io` or `docs.codeberg.page`. From here, 1.1.1.1, 8.8.8.8 and 9.9.9.9 answer these queries with SERVFAIL or REFUSED and mark their replies "recursion available". A real root server never does either. dnswatcher itself is affected the same way on such a network. It fails for names the resolver has not cached, and for names it has cached it reports the resolver's cached answer as if each nameserver had given it.
**Fix, as one PR on `next`, in the resolver (`internal/resolver`):**
1. A reply over UDP marked "recursion available" is asked again over TCP, and the TCP reply is used. Many networks redirect only UDP DNS.
2. A reply from a root server that is still marked "recursion available" cannot have come from a root server, so it is not used. When every root server either refused or gave such a reply, the error is the existing "this network intercepts DNS queries". Today that error covers only the case where every root server refuses.
3. Live tests, with no DNS mocked: several public recursive resolvers stand in for the root servers, the same way the existing interception tests use google.com's nameservers, and the result is that error. The README's DNS Resolution Strategy section says what happens on such a network.
4. Checked by hand, with nothing committed: the built image, run in a throwaway container whose outgoing UDP port 53 is redirected to a public resolver, fails as in your log before the change and resolves after it. With TCP redirected too, it reports the interception error.
This makes `make check` pass on a network that intercepts DNS over UDP only. If yours intercepts TCP as well, the tests and dnswatcher will fail with that clear message instead. The only change left after that would be to which tests run, and that would come back to you here as a question.
**To find out which case you have** (optional, nothing waits on it), run these on the machine where `make check` failed:
```
dig +norec @198.41.0.4 desec.io NS
dig +norec +tcp @198.41.0.4 desec.io NS
```
A real root server answers `status: NOERROR` with no `ra` in the `flags:` line. If you see `ra` or `SERVFAIL`, the answer came from your network instead. The second command shows whether that also happens over TCP.
Model: opus-5-5
Ruling (sneak, 2026-10-16, #301 (comment)): on a network that filters or alters DNS, the tests should fail. PR 301's retry over TCP, which made them pass there, is dropped.
PR 301 also had a second part. On such a network the intercepting resolver answers in place of the root servers and the domains' own nameservers. For names it has cached, dnswatcher today accepts that answer as if each nameserver had given it, so some checks pass with second-hand data; for the rest it fails with "reply is an error or a referral that leads no closer". The second part spots that a reply claiming to come from a root server came from a resolver (only a resolver marks it "recursion available") and stops with the plain error "this network intercepts DNS queries", for cached and uncached names alike.
Question for sneak: which?
A: keep only that second part, so dnswatcher and its tests fail on such a network every time, with that plain error;
B: no code change; close this issue, since the tests already failed on your network as they should.
Recommendation: A. It fails in every case, never on second-hand answers, and the message names the cause.
Model: opus-5-5
**Ruling (sneak, 2026-10-16, https://git.eeqj.de/sneak/dnswatcher/pulls/301#issuecomment-144949):** on a network that filters or alters DNS, the tests should fail. PR 301's retry over TCP, which made them pass there, is dropped.
PR 301 also had a second part. On such a network the intercepting resolver answers in place of the root servers and the domains' own nameservers. For names it has cached, dnswatcher today accepts that answer as if each nameserver had given it, so some checks pass with second-hand data; for the rest it fails with "reply is an error or a referral that leads no closer". The second part spots that a reply claiming to come from a root server came from a resolver (only a resolver marks it "recursion available") and stops with the plain error "this network intercepts DNS queries", for cached and uncached names alike.
**Question for sneak:** which?
- A: keep only that second part, so dnswatcher and its tests fail on such a network every time, with that plain error;
- B: no code change; close this issue, since the tests already failed on your network as they should.
**Recommendation:** A. It fails in every case, never on second-hand answers, and the message names the cause.
Model: opus-5-5
sneak
was assigned by clawbot2026-10-16 10:07:59 +02:00
sneak's check (#301 (comment)): from his machine, a.root-servers.net answers SERVFAIL with ra set over both UDP and TCP. A real root server does neither, so his network intercepts DNS over both, and the test failures there are correct. The A/B question above still stands.
Model: opus-5-5
sneak's check (https://git.eeqj.de/sneak/dnswatcher/pulls/301#issuecomment-144955): from his machine, `a.root-servers.net` answers `SERVFAIL` with `ra` set over both UDP and TCP. A real root server does neither, so his network intercepts DNS over both, and the test failures there are correct. The A/B question above still stands.
Model: opus-5-5
Ruling (sneak, 2026-10-16, in chat): A. PR 301 keeps only the part that spots a reply marked "recursion available" from a root server's address and stops with the plain error "this network intercepts DNS queries", for cached and uncached names alike. No retry over TCP or anywhere else; nothing works around the interception. dnswatcher and its tests fail on such a network every time.
Next: the dnswatcher manager reworks #301 to exactly that, then an independent review, then a squash-merge to next.
Model: opus-5-5
**Ruling (sneak, 2026-10-16, in chat): A.** PR 301 keeps only the part that spots a reply marked "recursion available" from a root server's address and stops with the plain error "this network intercepts DNS queries", for cached and uncached names alike. No retry over TCP or anywhere else; nothing works around the interception. dnswatcher and its tests fail on such a network every time.
**Next:** the dnswatcher manager reworks https://git.eeqj.de/sneak/dnswatcher/pulls/301 to exactly that, then an independent review, then a squash-merge to `next`.
Model: opus-5-5
sneak
was unassigned by clawbot2026-10-16 10:12:05 +02:00
clawbot
self-assigned this 2026-10-16 10:12:05 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
script/cibuildon a fresh clone ofnext(adc8131) passes on this host.Cause. Something on your network answers DNS queries sent to port 53 at any address itself, instead of passing them to the server they were sent to. This is usually a router rule that sends all DNS to one resolver, a VPN, or a DNS filter. dnswatcher asks the root servers and each domain's own nameservers directly, and it never asks for recursion. A recursive resolver that gets such a query answers only from its cache, and for a name it has not cached it replies with an error. That error is the "reply is an error or a referral that leads no closer" in your log. It also explains why names a resolver probably had cached, such as
google.com, got further thandesec.ioordocs.codeberg.page. From here, 1.1.1.1, 8.8.8.8 and 9.9.9.9 answer these queries with SERVFAIL or REFUSED and mark their replies "recursion available". A real root server never does either. dnswatcher itself is affected the same way on such a network. It fails for names the resolver has not cached, and for names it has cached it reports the resolver's cached answer as if each nameserver had given it.Fix, as one PR on
next, in the resolver (internal/resolver):This makes
make checkpass on a network that intercepts DNS over UDP only. If yours intercepts TCP as well, the tests and dnswatcher will fail with that clear message instead. The only change left after that would be to which tests run, and that would come back to you here as a question.To find out which case you have (optional, nothing waits on it), run these on the machine where
make checkfailed:A real root server answers
status: NOERRORwith norain theflags:line. If you seeraorSERVFAIL, the answer came from your network instead. The second command shows whether that also happens over TCP.Model: opus-5-5
Ruling (sneak, 2026-10-16, #301 (comment)): on a network that filters or alters DNS, the tests should fail. PR 301's retry over TCP, which made them pass there, is dropped.
PR 301 also had a second part. On such a network the intercepting resolver answers in place of the root servers and the domains' own nameservers. For names it has cached, dnswatcher today accepts that answer as if each nameserver had given it, so some checks pass with second-hand data; for the rest it fails with "reply is an error or a referral that leads no closer". The second part spots that a reply claiming to come from a root server came from a resolver (only a resolver marks it "recursion available") and stops with the plain error "this network intercepts DNS queries", for cached and uncached names alike.
Question for sneak: which?
Recommendation: A. It fails in every case, never on second-hand answers, and the message names the cause.
Model: opus-5-5
sneak's check (#301 (comment)): from his machine,
a.root-servers.netanswersSERVFAILwithraset over both UDP and TCP. A real root server does neither, so his network intercepts DNS over both, and the test failures there are correct. The A/B question above still stands.Model: opus-5-5
Ruling (sneak, 2026-10-16, in chat): A. PR 301 keeps only the part that spots a reply marked "recursion available" from a root server's address and stops with the plain error "this network intercepts DNS queries", for cached and uncached names alike. No retry over TCP or anywhere else; nothing works around the interception. dnswatcher and its tests fail on such a network every time.
Next: the dnswatcher manager reworks #301 to exactly that, then an independent review, then a squash-merge to
next.Model: opus-5-5