fix(resolver): reply to NOTFQDN queries with a well-formed NXDOMAIN (#2250)

With `fqdnOnly` enabled, a query for a dotless name was answered with a
dns.Msg carrying only an Rcode: NewEmptyResponse called neither SetReply nor
SetRcode, so the message echoed back neither the request id nor the question
section. Conforming clients discard such an answer as an id mismatch and go
on waiting for a reply that never comes, so users saw a timeout instead of
the NXDOMAIN the documentation promises.

Build the answer with NewResponseWithRcode instead, whose SetRcode echoes id
and question, and drop NewEmptyResponse: FQDNOnlyResolver was its only
caller, and every other resolver already replies via SetReply.

The e2e test accepted "any DNS error" as a valid rejection, which is why this
went unnoticed; it now asserts that the client actually receives NXDOMAIN
with its question echoed back.

Claude-Session: https://claude.ai/code/session_01QyEFFhrY3j9QtGzR2wUJr9

Author: 0xERR0R

e2e/fqdn_only_test.go

@@ -41,14 +41,17 @@ var _ = Describe("FQDN only mode", func() {
 			Expect(err).Should(Succeed())
 		})
 
-		It("should reject non-FQDN queries", func(ctx context.Context) {
+		It("should reject non-FQDN queries with NXDOMAIN", func(ctx context.Context) {
 			msg := util.NewMsgWithQuestion("myserver.", A)
+
+			// the rejection must be a reply the client accepts: one that echoes the request id
+			// and question. A bare Rcode-only message is discarded as an id mismatch, leaving
+			// the client to time out instead of seeing the NXDOMAIN.
 			resp, err := doDNSRequest(ctx, blocky, msg)
-			if err != nil {
-				// Any DNS error (connection refused, id mismatch, etc.) is a valid rejection
-				return
-			}
+			Expect(err).Should(Succeed())
 			Expect(resp.Rcode).Should(Equal(dns.RcodeNameError))
+			Expect(resp.Question).Should(Equal(msg.Question))
+			Expect(resp.Answer).Should(BeEmpty())
 		})
 
 		It("should resolve FQDN queries normally", func(ctx context.Context) {

model/response_helpers.go

@@ -42,16 +42,3 @@ func NewResponseWithRcode(request *Request, rcode int, rtype ResponseType, reaso
 		Reason: reason,
 	}
 }
-
-// NewEmptyResponse creates a response with just the Rcode field set (no SetReply or SetRcode).
-// This is used for minimal responses where only the return code matters.
-func NewEmptyResponse(request *Request, rcode int, rtype ResponseType, reason string) *Response {
-	response := new(dns.Msg)
-	response.Rcode = rcode
-
-	return &Response{
-		Res:    response,
-		RType:  rtype,
-		Reason: reason,
-	}
-}

resolver/fqdn_only_resolver.go

@@ -27,7 +27,7 @@ func (r *FQDNOnlyResolver) Resolve(ctx context.Context, request *model.Request)
 	if r.IsEnabled() {
 		domainFromQuestion := util.ExtractDomain(request.Req.Question[0])
 		if !strings.Contains(domainFromQuestion, ".") {
-			return model.NewEmptyResponse(request, dns.RcodeNameError, model.ResponseTypeNOTFQDN, "NOTFQDN"), nil
+			return model.NewResponseWithRcode(request, dns.RcodeNameError, model.ResponseTypeNOTFQDN, "NOTFQDN"), nil
 		}
 	}
 

resolver/fqdn_only_resolver_test.go

@@ -88,6 +88,18 @@ var _ = Describe("FqdnOnlyResolver", func() {
 			// no call of next resolver
 			Expect(m.Calls).Should(BeZero())
 		})
+		It("Should reply to the request, echoing its id and question", func() {
+			request := newRequest("example", AAAA)
+
+			resp, err := sut.Resolve(ctx, request)
+			Expect(err).Should(Succeed())
+
+			// a reply that carries neither the request id nor the question is rejected by the
+			// client as an id mismatch, so it sees a timeout instead of the NXDOMAIN
+			Expect(resp.Res.Response).Should(BeTrue())
+			Expect(resp.Res.Id).Should(Equal(request.Req.Id))
+			Expect(resp.Res.Question).Should(Equal(request.Req.Question))
+		})
 
 		Describe("IsEnabled", func() {
 			It("is true", func() {