DNS authority management and features

Improve NS record handling with glue A-records for healthy targets

Update DNS Authority feature with configuration options and conflict checks

Add self-test functionality for DNS Authority server startup

Author: mattv8

README.md

@@ -25,6 +25,32 @@ When Newt receives WireGuard control messages, it will use the information encod
 
 When Newt receives WireGuard control messages, it will use the information encoded to create a local low level TCP and UDP proxies attached to the virtual tunnel in order to relay traffic to programmed targets.
 
+### DNS Authority
+
+Newt includes an authoritative DNS server that can serve customized DNS records for specific domains (zones) managed by Pangolin. This allows for intelligent routing and high-availability setups where Newt can respond with the healthiest target IPs for a given service.
+
+The DNS server runs on port 53 (UDP/TCP). By default, it binds to `0.0.0.0`, but this can be customized using the `--dns-bind` flag or `DNS_BIND_ADDR` environment variable.
+
+#### systemd-resolved Conflict
+
+On many modern Linux distributions, `systemd-resolved` binds to `127.0.0.53:53`, which prevents Newt from binding to `0.0.0.0:53`. To resolve this, you can:
+1.  Disable `systemd-resolved`: `sudo systemctl disable --now systemd-resolved`
+2.  Or bind Newt to a specific public IP that doesn't conflict with the loopback address used by resolved: `--dns-bind 1.2.3.4`
+3.  Or disable the DNS Authority feature entirely if you don't need it: `--disable-dns-authority`
+
+## Configuration
+
+Newt can be configured via environment variables or command-line flags.
+
+| Environment Variable | Flag | Description | Default |
+|----------------------|------|-------------|---------|
+| `PANGOLIN_ENDPOINT` | `--endpoint` | Pangolin server endpoint | |
+| `NEWT_ID` | `--id` | Newt Site ID | |
+| `NEWT_SECRET` | `--secret` | Newt Site Secret | |
+| `DNS_BIND_ADDR` | `--dns-bind` | Bind address for DNS Authority | `0.0.0.0` |
+| `DISABLE_DNS_AUTHORITY` | `--disable-dns-authority` | Disable the DNS Authority server | `false` |
+| `LOG_LEVEL` | `--log-level` | Logging level (DEBUG, INFO, WARN, ERROR, FATAL) | `INFO` |
+
 ## Build
 
 ### Binary