atenet/dns: return NODATA for non-A queries on actor zone

[SURAJ KUMAR (krsnaSuraj)]

atenet/dns: return NODATA for non-A queries on actor zone

Fixes #888

Problem

The actor zone only had a template IN A block. CoreDNS's template plugin returns SERVFAIL when the plugin's zone matches a query name but no template block matches the query type. Strict POSIX resolvers query A and AAAA in parallel and treat SERVFAIL as a hard failure — breaking intra-cluster resolution for actor images that only have IPv4 addresses.

Fix

Add a template IN ANY block (with no answer) that matches the same actor names. Per the CoreDNS template plugin docs, specifying no answer results in a response with an empty answer section and default rcode NOERROR — the NODATA response RFC 8020 expects for a name that exists but has no records of the requested type.

Testing

• go test ./cmd/atenet/internal/dns/ -count=1 — passes
• go build ./cmd/atenet/internal/dns/ — clean
• gofmt -l cmd/atenet/internal/dns/ — clean
• Generated Corefile verified to contain both blocks:

  template IN A actors.resources.substrate.ate.dev {
    match "^[a-z0-9]([-a-z0-9]*[a-z0-9])?\.[a-z0-9]([-a-z0-9]*[a-z0-9])?\.actors\.resources\.substrate\.ate\.dev\.$"
    answer "{{ .Name }} 60 IN A 10.240.0.10"
  }
  template IN ANY actors.resources.substrate.ate.dev {
    match "^[a-z0-9]([-a-z0-9]*[a-z0-9])?\.[a-z0-9]([-a-z0-9]*[a-z0-9])?\.actors\.resources\.substrate\.ate\.dev\.$"
  }
  

Notes

• The ANY template comes after A, so A queries are still answered first.
• No answer in the ANY block → empty NOERROR (NODATA), not NXDOMAIN — the zone apex and empty non-terminals remain distinct (see atenet/dns: actor zone returns NXDOMAIN for empty non-terminals #922).

[Yuan Gao (ygao-g)]

FYI I already opened a PR for the issue #888

[SURAJ KUMAR (krsnaSuraj)]

Thanks for the heads-up Yuan Gao (@ygao-g) — you're right, #874 covers the same ground (Fixes #888) and was opened a week earlier.

I compared both implementations:

• atenet/dns: answer non-A actor queries instead of SERVFAIL #874 adds template ANY ANY with a SOA authority record and fallthrough, plus README docs. The SOA is what makes the NODATA response negatively cacheable per RFC 2308, and the fallthrough keeps non-actor names in the zone from being swallowed.
• atenet/dns: return NODATA for non-A queries on actor zone #1062 (mine) adds template IN ANY with an empty answer and no SOA/fallthrough. It returns NOERROR/NODATA for non-A qtypes on valid actor names, which fixes the musl/AAAA-strict-resolver failure mode, but it's the thinner fix of the two.

#874 is the more complete and correct approach — it landed first and handles the negative-caching and NXDOMAIN cases properly. I'll close #1062 in favor of it. Thanks for the catch.

[SURAJ KUMAR (krsnaSuraj)]

Closing in favor of #874 (same fix, opened earlier, more complete with SOA authority + fallthrough + docs). Thanks Yuan Gao (@ygao-g) for the FYI.