Fix DNS truncation, IPv6, and SERVFAIL handling in scanner

- Add EDNS0 (1232-byte buffer) to all DNS queries to avoid 512-byte UDP truncation
- Add TCP fallback when responses are truncated (TC bit set)
- Use net.JoinHostPort() everywhere for IPv6 address safety
- Let QueryNS/QueryDoHNS inspect Authority section on non-SUCCESS Rcode
  (fixes subdomain NS delegation detection through SERVFAIL responses)

Author: SamNet-dev

internal/scanner/dns.go

@@ -2,15 +2,21 @@ package scanner
 
 import (
 	"context"
+	"net"
 	"time"
 
 	"github.com/miekg/dns"
 )
 
-func query(resolver, domain string, qtype uint16, timeout time.Duration) (*dns.Msg, bool) {
+// queryRaw sends a DNS query and handles EDNS0 + TCP fallback on truncation.
+// Returns the response regardless of Rcode, so callers can inspect Authority section.
+func queryRaw(resolver, domain string, qtype uint16, timeout time.Duration) (*dns.Msg, bool) {
 	m := new(dns.Msg)
 	m.SetQuestion(dns.Fqdn(domain), qtype)
 	m.RecursionDesired = true
+	m.SetEdns0(1232, false)
+
+	addr := net.JoinHostPort(resolver, "53")
 
 	c := new(dns.Client)
 	c.Net = "udp"
@@ -19,8 +25,26 @@ func query(resolver, domain string, qtype uint16, timeout time.Duration) (*dns.M
 	ctx, cancel := context.WithTimeout(context.Background(), timeout)
 	defer cancel()
 
-	r, _, err := c.ExchangeContext(ctx, m, resolver+":53")
-	if err != nil || r == nil || r.Rcode != dns.RcodeSuccess {
+	r, _, err := c.ExchangeContext(ctx, m, addr)
+	if err != nil || r == nil {
+		return nil, false
+	}
+
+	// Retry over TCP if response was truncated
+	if r.Truncated {
+		c.Net = "tcp"
+		r, _, err = c.ExchangeContext(ctx, m, addr)
+		if err != nil || r == nil {
+			return nil, false
+		}
+	}
+
+	return r, true
+}
+
+func query(resolver, domain string, qtype uint16, timeout time.Duration) (*dns.Msg, bool) {
+	r, ok := queryRaw(resolver, domain, qtype, timeout)
+	if !ok || r.Rcode != dns.RcodeSuccess {
 		return nil, false
 	}
 	return r, true
@@ -35,7 +59,7 @@ func QueryA(resolver, domain string, timeout time.Duration) bool {
 }
 
 func QueryNS(resolver, domain string, timeout time.Duration) ([]string, bool) {
-	r, ok := query(resolver, domain, dns.TypeNS, timeout)
+	r, ok := queryRaw(resolver, domain, dns.TypeNS, timeout)
 	if !ok {
 		return nil, false
 	}

internal/scanner/doh.go

@@ -20,8 +20,9 @@ var dohHTTPClient = &http.Client{
 	},
 }
 
-// QueryDoH sends a DNS query to a DoH resolver URL and returns the response.
-func QueryDoH(resolverURL, domain string, qtype uint16, timeout time.Duration) (*dns.Msg, bool) {
+// queryDoHRaw sends a DNS query to a DoH resolver and returns the response
+// regardless of Rcode, so callers can inspect Authority section.
+func queryDoHRaw(resolverURL, domain string, qtype uint16, timeout time.Duration) (*dns.Msg, bool) {
 	m := new(dns.Msg)
 	m.SetQuestion(dns.Fqdn(domain), qtype)
 	m.RecursionDesired = true
@@ -61,10 +62,16 @@ func QueryDoH(resolverURL, domain string, qtype uint16, timeout time.Duration) (
 		return nil, false
 	}
 
-	if reply.Rcode != dns.RcodeSuccess {
+	return reply, true
+}
+
+// QueryDoH sends a DNS query to a DoH resolver URL and returns the response.
+func QueryDoH(resolverURL, domain string, qtype uint16, timeout time.Duration) (*dns.Msg, bool) {
+	r, ok := queryDoHRaw(resolverURL, domain, qtype, timeout)
+	if !ok || r.Rcode != dns.RcodeSuccess {
 		return nil, false
 	}
-	return reply, true
+	return r, true
 }
 
 // QueryDoHA tests if a DoH resolver can resolve an A record.
@@ -78,7 +85,7 @@ func QueryDoHA(resolverURL, domain string, timeout time.Duration) bool {
 
 // QueryDoHNS queries NS records via DoH.
 func QueryDoHNS(resolverURL, domain string, timeout time.Duration) ([]string, bool) {
-	r, ok := QueryDoH(resolverURL, domain, dns.TypeNS, timeout)
+	r, ok := queryDoHRaw(resolverURL, domain, dns.TypeNS, timeout)
 	if !ok {
 		return nil, false
 	}

internal/scanner/e2e.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"net"
 	"os/exec"
 	"runtime"
 	"strings"
@@ -47,7 +48,7 @@ func dnsttCheck(bin, domain, pubkey, testURL, proxyAuth string, ports chan int)
 		start := time.Now()
 
 		cmd := execCommandContext(ctx, bin,
-			"-udp", ip+":53",
+			"-udp", net.JoinHostPort(ip, "53"),
 			"-pubkey", pubkey,
 			domain,
 			fmt.Sprintf("127.0.0.1:%d", port))
@@ -108,7 +109,7 @@ func slipstreamCheck(bin, domain, certPath, testURL, proxyAuth string, ports cha
 
 		args := []string{
 			"-d", domain,
-			"-r", ip + ":53",
+			"-r", net.JoinHostPort(ip, "53"),
 			"-l", fmt.Sprintf("%d", port),
 		}
 		if certPath != "" {

internal/scanner/edns.go

@@ -3,6 +3,7 @@ package scanner
 import (
 	"context"
 	"fmt"
+	"net"
 	"time"
 
 	"github.com/miekg/dns"
@@ -55,7 +56,7 @@ func testEDNSPayload(resolver, domain string, payload uint16, timeout time.Durat
 		c.Timeout = timeout
 
 		ctx, cancel := context.WithTimeout(context.Background(), timeout)
-		r, _, err := c.ExchangeContext(ctx, m, resolver+":53")
+		r, _, err := c.ExchangeContext(ctx, m, net.JoinHostPort(resolver, "53"))
 		cancel()
 
 		if err != nil || r == nil {

internal/scanner/nxdomain.go

@@ -3,6 +3,7 @@ package scanner
 import (
 	"fmt"
 	"math/rand"
+	"net"
 	"time"
 
 	"github.com/miekg/dns"
@@ -34,7 +35,7 @@ func NXDomainCheck(count int) CheckFunc {
 			c.Net = "udp"
 			c.Timeout = timeout
 
-			r, _, err := c.Exchange(m, ip+":53")
+			r, _, err := c.Exchange(m, net.JoinHostPort(ip, "53"))
 			if err != nil || r == nil {
 				continue
 			}