check / check (push) Waiting to run
dnswatcher never asks for recursion and a root server never offers it, so a reply marked recursion available from a root server's address came from a resolver on the network answering in its place. The first such reply, a refusal included, now stops the lookup at once with the existing "this network intercepts DNS queries", naming the address, and no other root server is asked, whether or not that resolver had the name cached. queryDNS now returns a refused reply along with ErrRefused, so the mark on a refusal can be seen. A refusal without the mark is passed over and counted as before. On such a network dnswatcher and its tests fail with that error, by design. A live test passes public resolvers as the root servers and expects it. Model: opus-5-5