Say why the exit path fell back, and widen the DNS "good" band

The Connection panel said "default path - your exit-path target didn't resolve"
whenever a traceroute could not use the target you configured. That is only one
of the two reasons it happens, and it is the less common one.

The other is that the target resolved perfectly well and was refused. A target
pointing at loopback or a link-local address would trace this machine or the
cloud metadata endpoint rather than an exit path, so it is declined on purpose.
Telling that operator their name did not resolve sends them to look for a DNS
fault that was never there.

The reason now travels with the flag, and the panel says which applied. An
address on your LAN is still allowed, because tracing a LAN gateway is a
reasonable thing to want.

Separately: the DNS dot now stays at full strength up to 40ms rather than 30.
That probe deliberately defeats every cache, so the resolver has to go and ask
rather than answer from memory, and a healthy lookup is a real round trip. Twenty
to forty milliseconds is ordinary for one, and the old boundary made normal
setups look worse than they were.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: cansofgrease

internal/netinfo/exit.go

@@ -90,9 +90,24 @@ type ExitInfo struct {
 	NextRTTms float64 `json:"next_rtt_ms,omitempty"`
 	NextASN   string  `json:"next_asn,omitempty"`
 	NextLoc   string  `json:"next_loc,omitempty"` // city of the handoff hop
-	// TargetFallback is true when the configured exit target didn't resolve to
-	// an IPv4 address, so this is the DEFAULT path (1.1.1.1), not the user's.
+	// TargetFallback is true when the configured exit target could not be used,
+	// so this is the DEFAULT path (1.1.1.1), not the user's.
 	TargetFallback bool `json:"target_fallback,omitempty"`
+	// TargetFallbackWhy says WHICH of the two reasons applied, because they need
+	// opposite responses and the bool alone sent readers to the wrong one: a
+	// target that resolves perfectly well but points somewhere internal was
+	// refused on purpose, and telling that operator it "did not resolve" starts a
+	// DNS hunt for a decision this code made deliberately.
+	//
+	//	"unresolved" - no IPv4 address (transient DNS failure, or an IPv6-only
+	//	               name the IPv4 traceroute cannot use). Retry or fix the name.
+	//	"internal"   - resolved to loopback or link-local, which would trace the
+	//	               host itself or the cloud-metadata endpoint rather than an
+	//	               exit path. Refused; pick a target outside the machine.
+	//
+	// Empty whenever TargetFallback is false. RFC1918 is deliberately NOT a
+	// reason - tracing a LAN gateway is legitimate (see isInternalTraceTarget).
+	TargetFallbackWhy string `json:"target_fallback_why,omitempty"`
 }
 
 // discoverExit traces toward target (resolved by cachedExit) and locates the
@@ -562,12 +577,12 @@ func (m *Manager) cachedExit(ctx context.Context, ourASN string) *ExitInfo {
 	// what was actually traced: an unresolvable target (transient DNS failure,
 	// or an IPv6-only name the IPv4 traceroute can't use) falls back to the
 	// default path, flagged so the UI doesn't present it as the chosen one.
-	target, fellBack := traceTarget, false
+	target, fellBackWhy := traceTarget, ""
 	if want != "" {
 		v, ok := resolveIPv4(ctx, want)
 		switch {
 		case !ok:
-			fellBack = true
+			fellBackWhy = "unresolved"
 			if ctx.Err() == nil { // don't blame the target when the caller aborted
 				m.log.Warn("exit target did not resolve to IPv4; tracing the default path", "target", want)
 			}
@@ -578,15 +593,16 @@ func (m *Manager) cachedExit(ctx context.Context, ourASN string) *ExitInfo {
 			// and trace the default. RFC1918 stays allowed on purpose: tracing a LAN
 			// gateway is legitimate and the trust model already equates dashboard
 			// access with local-network reach.
-			fellBack = true
+			fellBackWhy = "internal"
 			m.log.Warn("exit target resolves to a loopback/link-local address; tracing the default path", "target", want)
 		default:
 			target = v
 		}
 	}
 	ex, err := m.discoverExit(ctx, ourASN, target)
 	if err == nil && ex != nil {
-		ex.TargetFallback = fellBack
+		ex.TargetFallback = fellBackWhy != ""
+		ex.TargetFallbackWhy = fellBackWhy
 	}
 	// A trace cut short by the CALLER (browser abort mid-refresh, shutdown) is not
 	// a real failure: it must neither skew the trace_ok/trace_fail counters nor

internal/netinfo/exit_test.go

@@ -2,6 +2,7 @@ package netinfo
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"io"
 	"log/slog"
@@ -398,3 +399,64 @@ func TestRefreshDropsStaleExitOnIPChangeWhenRetraceFails(t *testing.T) {
 		t.Error("IP change with successful retrace must publish the new network's exit, got nil")
 	}
 }
+
+// The two fallback causes must stay distinguishable on the wire, because they
+// need opposite responses from an operator and the bool alone cannot say which.
+//
+// "unresolved" is a name to retry or fix. "internal" resolved perfectly well and
+// was refused on purpose - loopback and link-local would trace this machine or
+// the cloud-metadata endpoint rather than an exit path. The dashboard used to
+// print "your exit-path target didn't resolve" for both, which sent the second
+// operator hunting a DNS fault that did not exist.
+//
+// The reason is asserted as the literal string the JSON carries: the dashboard
+// switches on those exact values (target_fallback_why in index.html), so renaming
+// one here without the other silently drops the UI back to its vaguest wording.
+//
+// SCOPE, so nobody reads more into this than it proves: it pins the wire contract
+// - which strings exist, and that the flag and the reason never disagree. It does
+// NOT pin which branch of cachedExit assigns which reason. resolveIPv4 is a plain
+// function and the surrounding path runs a real traceroute, so covering that would
+// mean opening a seam in production code, and a two-line switch does not earn one.
+// Swapping the two literals at the assignment would pass this test.
+func TestExitTargetFallbackNamesItsReason(t *testing.T) {
+	// The bool and the reason are one fact recorded twice, so they must never
+	// disagree: a reason without the flag hides the fallback from the UI's
+	// existing check, and a flag without a reason is the ambiguity this closes.
+	for _, c := range []struct {
+		name string
+		why  string
+		flag bool
+	}{
+		{"target resolved and was used", "", false},
+		{"no IPv4 address for the name", "unresolved", true},
+		{"resolved to loopback or link-local", "internal", true},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			ex := &ExitInfo{TargetFallback: c.why != "", TargetFallbackWhy: c.why}
+			if ex.TargetFallback != c.flag {
+				t.Fatalf("TargetFallback = %v, want %v", ex.TargetFallback, c.flag)
+			}
+			b, err := json.Marshal(ex)
+			if err != nil {
+				t.Fatalf("marshal: %v", err)
+			}
+			var got map[string]any
+			if err := json.Unmarshal(b, &got); err != nil {
+				t.Fatalf("unmarshal: %v", err)
+			}
+			w, present := got["target_fallback_why"]
+			if c.why == "" {
+				if present {
+					t.Errorf("target_fallback_why = %v on a run that used its target, want the "+
+						"field omitted so a reader cannot read a reason into a normal trace", w)
+				}
+				return
+			}
+			if !present || w != c.why {
+				t.Errorf("target_fallback_why = %v (present=%v), want %q - the dashboard switches "+
+					"on this exact string", w, present, c.why)
+			}
+		})
+	}
+}

internal/web/ui/index.html

@@ -4164,8 +4164,13 @@ <h2><span class="drag-handle" title="Drag to reorder" aria-hidden="true"><svg vi
     : ms<10 ? hdot(100,v) : ms<100 ? hdot(45,v) : ms<200 ? hdot(30,v) : hdot(20,v);
   // DNS resolve-time intensity scale, shared by the top-bar DNS pill and the
   // latency-graph DNS pill - mirrors latDot's aggression with DNS-appropriate bands:
-  // full <30ms, a hard cliff to 45% under 100ms, then the 20% floor at ≥100ms.
-  const dnsPct = ms => ms<30 ? 100 : ms<100 ? 45 : 20;
+  // full <40ms, a hard cliff to 45% under 100ms, then the 20% floor at ≥100ms.
+  //
+  // The full band is 40ms, not the 10ms latDot uses, because this probe cannot be
+  // fast by construction: the random label defeats every cache on the path, so the
+  // resolver has to go and ask rather than answer from memory. A healthy lookup is
+  // therefore a real round trip to an authority, and 20-40ms is ordinary for one.
+  const dnsPct = ms => ms<40 ? 100 : ms<100 ? 45 : 20;
   const dnsDot = ms => hdot(dnsPct(ms), '--dot-dns');
   // Pill latency text: 1 decimal under 100 ms, whole ms at 100+ - keeps precision
   // where it's useful without widening the value slot on high/spiky readings.
@@ -6441,10 +6446,26 @@ <h2><span class="drag-handle" title="Drag to reorder" aria-hidden="true"><svg vi
       parts.push(`${esc(ex.next_name||ex.next_ip)}${b.length?` <span class="muted">(${b.join(' · ')})</span>`:''}`);
     }
     let v=parts.join(' <span class="muted">→</span> ');
-    // The configured exit-path target didn't resolve over IPv4, so this trace
-    // followed the default path (1.1.1.1) - flag it so the row can't silently
-    // present the wrong route as the user's target.
-    if(ex && ex.target_fallback) v+=' <span class="muted">(default path - your exit-path target didn\'t resolve)</span>';
+    // The configured exit-path target could not be used, so this trace followed
+    // the default path (1.1.1.1) - flag it so the row can't silently present the
+    // wrong route as the user's target.
+    //
+    // Name the actual reason: the two need opposite responses. "unresolved" is a
+    // name to retry or fix; "internal" resolved fine and was refused on purpose,
+    // because loopback and link-local targets trace the host or the cloud
+    // metadata endpoint instead of an exit path (target_fallback_why, set in
+    // internal/netinfo/exit.go). Saying "did not resolve" for the second sent
+    // operators hunting a DNS fault that was never there. An older daemon sends
+    // the bool without the reason, so an unknown value falls back to the
+    // non-committal wording rather than guessing.
+    if(ex && ex.target_fallback){
+      const why = ex.target_fallback_why==='internal'
+        ? 'your exit-path target points inside this machine, so it cannot be traced'
+        : ex.target_fallback_why==='unresolved'
+          ? 'your exit-path target did not resolve'
+          : 'your exit-path target could not be used';
+      v+=' <span class="muted">(default path - '+why+')</span>';
+    }
     // Cloudflare PoP (colo) rides the Exit line after a · separator - a separate,
     // always-Cloudflare readout (/cdn-cgi/trace), not the exit-path target (see tooltip).
     if(n.cf_colo) v+=`${v?' <span class="muted">·</span> ':''}Cloudflare PoP <b>${esc(n.cf_colo)}</b>`;