[client] Chase CNAMEs in local resolver to ensure musl compatibility (#5046)

2026-04-18 16:26:38 +00:00 · 2026-01-12 19:35:38 +08:00
parent 614e7d5b90
commit 394ad19507
10 changed files with 1267 additions and 272 deletions
--- a/client/internal/dns/local/local.go
+++ b/client/internal/dns/local/local.go
@@ -1,30 +1,50 @@
 package local

 import (
+	"context"
+	"errors"
 	"fmt"
+	"net"
+	"net/netip"
 	"slices"
 	"strings"
 	"sync"
+	"time"

 	"github.com/miekg/dns"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/exp/maps"

+	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/dns/types"
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/shared/management/domain"
 )

+const externalResolutionTimeout = 4 * time.Second
+
+type resolver interface {
+	LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
+}
+
 type Resolver struct {
-	mu      sync.RWMutex
-	records map[dns.Question][]dns.RR
-	domains map[domain.Domain]struct{}
+	mu       sync.RWMutex
+	records  map[dns.Question][]dns.RR
+	domains  map[domain.Domain]struct{}
+	zones    []domain.Domain
+	resolver resolver
+
+	ctx    context.Context
+	cancel context.CancelFunc
 }

 func NewResolver() *Resolver {
+	ctx, cancel := context.WithCancel(context.Background())
 	return &Resolver{
 		records: make(map[dns.Question][]dns.RR),
 		domains: make(map[domain.Domain]struct{}),
+		ctx:     ctx,
+		cancel:  cancel,
 	}
 }

@@ -37,7 +57,18 @@ func (d *Resolver) String() string {
 	return fmt.Sprintf("LocalResolver [%d records]", len(d.records))
 }

-func (d *Resolver) Stop() {}
+func (d *Resolver) Stop() {
+	if d.cancel != nil {
+		d.cancel()
+	}
+
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	maps.Clear(d.records)
+	maps.Clear(d.domains)
+	d.zones = nil
+}

 // ID returns the unique handler ID
 func (d *Resolver) ID() types.HandlerID {
@@ -48,38 +79,47 @@ func (d *Resolver) ProbeAvailability() {}

 // ServeDNS handles a DNS request
 func (d *Resolver) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
+	logger := log.WithField("request_id", resutil.GetRequestID(w))
+
 	if len(r.Question) == 0 {
-		log.Debugf("received local resolver request with no question")
+		logger.Debug("received local resolver request with no question")
 		return
 	}
 	question := r.Question[0]
 	question.Name = strings.ToLower(dns.Fqdn(question.Name))

-	log.Tracef("received local question: domain=%s type=%v class=%v", r.Question[0].Name, question.Qtype, question.Qclass)
-
 	replyMessage := &dns.Msg{}
 	replyMessage.SetReply(r)
 	replyMessage.RecursionAvailable = true

-	// lookup all records matching the question
-	records := d.lookupRecords(question)
-	if len(records) > 0 {
-		replyMessage.Rcode = dns.RcodeSuccess
-		replyMessage.Answer = append(replyMessage.Answer, records...)
-	} else {
-		// Check if we have any records for this domain name with different types
-		if d.hasRecordsForDomain(domain.Domain(question.Name)) {
-			replyMessage.Rcode = dns.RcodeSuccess // NOERROR with 0 records
-		} else {
-			replyMessage.Rcode = dns.RcodeNameError // NXDOMAIN
-		}
-	}
+	result := d.lookupRecords(logger, question)
+	replyMessage.Authoritative = !result.hasExternalData
+	replyMessage.Answer = result.records
+	replyMessage.Rcode = d.determineRcode(question, result)

 	if err := w.WriteMsg(replyMessage); err != nil {
-		log.Warnf("failed to write the local resolver response: %v", err)
+		logger.Warnf("failed to write the local resolver response: %v", err)
 	}
 }

+// determineRcode returns the appropriate DNS response code.
+// Per RFC 6604, CNAME chains should return the rcode of the final target resolution,
+// even if CNAME records are included in the answer.
+func (d *Resolver) determineRcode(question dns.Question, result lookupResult) int {
+	// Use the rcode from lookup - this properly handles CNAME chains where
+	// the target may be NXDOMAIN or SERVFAIL even though we have CNAME records
+	if result.rcode != 0 {
+		return result.rcode
+	}
+
+	// No records found, but domain exists with different record types (NODATA)
+	if d.hasRecordsForDomain(domain.Domain(question.Name)) {
+		return dns.RcodeSuccess
+	}
+
+	return dns.RcodeNameError
+}
+
 // hasRecordsForDomain checks if any records exist for the given domain name regardless of type
 func (d *Resolver) hasRecordsForDomain(domainName domain.Domain) bool {
 	d.mu.RLock()
@@ -89,8 +129,33 @@ func (d *Resolver) hasRecordsForDomain(domainName domain.Domain) bool {
 	return exists
 }

+// isInManagedZone checks if the given name falls within any of our managed zones.
+// This is used to avoid unnecessary external resolution for CNAME targets that
+// are within zones we manage - if we don't have a record for it, it doesn't exist.
+// Caller must NOT hold the lock.
+func (d *Resolver) isInManagedZone(name string) bool {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	name = dns.Fqdn(name)
+	for _, zone := range d.zones {
+		zoneStr := dns.Fqdn(zone.PunycodeString())
+		if strings.EqualFold(name, zoneStr) || strings.HasSuffix(strings.ToLower(name), strings.ToLower("."+zoneStr)) {
+			return true
+		}
+	}
+	return false
+}
+
+// lookupResult contains the result of a DNS lookup operation.
+type lookupResult struct {
+	records         []dns.RR
+	rcode           int
+	hasExternalData bool
+}
+
 // lookupRecords fetches *all* DNS records matching the first question in r.
-func (d *Resolver) lookupRecords(question dns.Question) []dns.RR {
+func (d *Resolver) lookupRecords(logger *log.Entry, question dns.Question) lookupResult {
 	d.mu.RLock()
 	records, found := d.records[question]

@@ -98,10 +163,14 @@ func (d *Resolver) lookupRecords(question dns.Question) []dns.RR {
 		d.mu.RUnlock()
 		// alternatively check if we have a cname
 		if question.Qtype != dns.TypeCNAME {
-			question.Qtype = dns.TypeCNAME
-			return d.lookupRecords(question)
+			cnameQuestion := dns.Question{
+				Name:   question.Name,
+				Qtype:  dns.TypeCNAME,
+				Qclass: question.Qclass,
+			}
+			return d.lookupCNAMEChain(logger, cnameQuestion, question.Qtype)
 		}
-		return nil
+		return lookupResult{rcode: dns.RcodeNameError}
 	}

 	recordsCopy := slices.Clone(records)
@@ -119,16 +188,172 @@ func (d *Resolver) lookupRecords(question dns.Question) []dns.RR {
 		d.mu.Unlock()
 	}

-	return recordsCopy
+	return lookupResult{records: recordsCopy, rcode: dns.RcodeSuccess}
 }

-func (d *Resolver) Update(update []nbdns.SimpleRecord) {
+// lookupCNAMEChain follows a CNAME chain and returns the CNAME records along with
+// the final resolved record of the requested type. This is required for musl libc
+// compatibility, which expects the full answer chain rather than just the CNAME.
+func (d *Resolver) lookupCNAMEChain(logger *log.Entry, cnameQuestion dns.Question, targetType uint16) lookupResult {
+	const maxDepth = 8
+	var chain []dns.RR
+
+	for range maxDepth {
+		cnameRecords := d.getRecords(cnameQuestion)
+		if len(cnameRecords) == 0 {
+			break
+		}
+
+		chain = append(chain, cnameRecords...)
+
+		cname, ok := cnameRecords[0].(*dns.CNAME)
+		if !ok {
+			break
+		}
+
+		targetName := strings.ToLower(cname.Target)
+		targetResult := d.resolveCNAMETarget(logger, targetName, targetType, cnameQuestion.Qclass)
+
+		// keep following chain
+		if targetResult.rcode == -1 {
+			cnameQuestion = dns.Question{Name: targetName, Qtype: dns.TypeCNAME, Qclass: cnameQuestion.Qclass}
+			continue
+		}
+
+		return d.buildChainResult(chain, targetResult)
+	}
+
+	if len(chain) > 0 {
+		return lookupResult{records: chain, rcode: dns.RcodeSuccess}
+	}
+	return lookupResult{rcode: dns.RcodeSuccess}
+}
+
+// buildChainResult combines CNAME chain records with the target resolution result.
+// Per RFC 6604, the final rcode is propagated through the chain.
+func (d *Resolver) buildChainResult(chain []dns.RR, target lookupResult) lookupResult {
+	records := chain
+	if len(target.records) > 0 {
+		records = append(records, target.records...)
+	}
+
+	// preserve hasExternalData for SERVFAIL so caller knows the error came from upstream
+	if target.hasExternalData && target.rcode == dns.RcodeServerFailure {
+		return lookupResult{
+			records:         records,
+			rcode:           dns.RcodeServerFailure,
+			hasExternalData: true,
+		}
+	}
+
+	return lookupResult{
+		records:         records,
+		rcode:           target.rcode,
+		hasExternalData: target.hasExternalData,
+	}
+}
+
+// resolveCNAMETarget attempts to resolve a CNAME target name.
+// Returns rcode=-1 to signal "keep following the chain".
+func (d *Resolver) resolveCNAMETarget(logger *log.Entry, targetName string, targetType uint16, qclass uint16) lookupResult {
+	if records := d.getRecords(dns.Question{Name: targetName, Qtype: targetType, Qclass: qclass}); len(records) > 0 {
+		return lookupResult{records: records, rcode: dns.RcodeSuccess}
+	}
+
+	// another CNAME, keep following
+	if d.hasRecord(dns.Question{Name: targetName, Qtype: dns.TypeCNAME, Qclass: qclass}) {
+		return lookupResult{rcode: -1}
+	}
+
+	// domain exists locally but not this record type (NODATA)
+	if d.hasRecordsForDomain(domain.Domain(targetName)) {
+		return lookupResult{rcode: dns.RcodeSuccess}
+	}
+
+	// in our zone but doesn't exist (NXDOMAIN)
+	if d.isInManagedZone(targetName) {
+		return lookupResult{rcode: dns.RcodeNameError}
+	}
+
+	return d.resolveExternal(logger, targetName, targetType)
+}
+
+func (d *Resolver) getRecords(q dns.Question) []dns.RR {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+	return d.records[q]
+}
+
+func (d *Resolver) hasRecord(q dns.Question) bool {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+	_, ok := d.records[q]
+	return ok
+}
+
+// resolveExternal resolves a domain name using the system resolver.
+// This is used to resolve CNAME targets that point outside our local zone,
+// which is required for musl libc compatibility (musl expects complete answers).
+func (d *Resolver) resolveExternal(logger *log.Entry, name string, qtype uint16) lookupResult {
+	network := resutil.NetworkForQtype(qtype)
+	if network == "" {
+		return lookupResult{rcode: dns.RcodeNotImplemented}
+	}
+
+	resolver := d.resolver
+	if resolver == nil {
+		resolver = net.DefaultResolver
+	}
+
+	ctx, cancel := context.WithTimeout(d.ctx, externalResolutionTimeout)
+	defer cancel()
+
+	result := resutil.LookupIP(ctx, resolver, network, name, qtype)
+	if result.Err != nil {
+		d.logDNSError(logger, name, qtype, result.Err)
+		return lookupResult{rcode: result.Rcode, hasExternalData: true}
+	}
+
+	return lookupResult{
+		records:         resutil.IPsToRRs(name, result.IPs, 60),
+		rcode:           dns.RcodeSuccess,
+		hasExternalData: true,
+	}
+}
+
+// logDNSError logs DNS resolution errors for debugging.
+func (d *Resolver) logDNSError(logger *log.Entry, hostname string, qtype uint16, err error) {
+	qtypeName := dns.TypeToString[qtype]
+
+	var dnsErr *net.DNSError
+	if !errors.As(err, &dnsErr) {
+		logger.Debugf("DNS resolution failed for %s type %s: %v", hostname, qtypeName, err)
+		return
+	}
+
+	if dnsErr.IsNotFound {
+		logger.Tracef("DNS target not found: %s type %s", hostname, qtypeName)
+		return
+	}
+
+	if dnsErr.Server != "" {
+		logger.Debugf("DNS resolution failed for %s type %s server=%s: %v", hostname, qtypeName, dnsErr.Server, err)
+	} else {
+		logger.Debugf("DNS resolution failed for %s type %s: %v", hostname, qtypeName, err)
+	}
+}
+
+// Update updates the resolver with new records and zone information.
+// The zones parameter specifies which DNS zones this resolver manages.
+func (d *Resolver) Update(update []nbdns.SimpleRecord, zones []domain.Domain) {
 	d.mu.Lock()
 	defer d.mu.Unlock()

 	maps.Clear(d.records)
 	maps.Clear(d.domains)

+	d.zones = zones
+
 	for _, rec := range update {
 		if err := d.registerRecord(rec); err != nil {
 			log.Warnf("failed to register the record (%s): %v", rec, err)
--- a/client/internal/dns/local/local_test.go
+++ b/client/internal/dns/local/local_test.go
@@ -1,8 +1,14 @@
 package local

 import (
+	"context"
+	"fmt"
+	"net"
+	"net/netip"
 	"strings"
+	"sync"
 	"testing"
+	"time"

 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
@@ -10,8 +16,21 @@ import (

 	"github.com/netbirdio/netbird/client/internal/dns/test"
 	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/shared/management/domain"
 )

+// mockResolver implements resolver for testing
+type mockResolver struct {
+	lookupFunc func(ctx context.Context, network, host string) ([]netip.Addr, error)
+}
+
+func (m *mockResolver) LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error) {
+	if m.lookupFunc != nil {
+		return m.lookupFunc(ctx, network, host)
+	}
+	return nil, nil
+}
+
 func TestLocalResolver_ServeDNS(t *testing.T) {
 	recordA := nbdns.SimpleRecord{
 		Name:  "peera.netbird.cloud.",
@@ -110,7 +129,7 @@ func TestLocalResolver_Update_StaleRecord(t *testing.T) {
 	update2 := []nbdns.SimpleRecord{record2}

 	// Apply first update
-	resolver.Update(update1)
+	resolver.Update(update1, nil)

 	// Verify first update
 	resolver.mu.RLock()
@@ -122,7 +141,7 @@ func TestLocalResolver_Update_StaleRecord(t *testing.T) {
 	assert.Contains(t, rrSlice1[0].String(), record1.RData, "Record after first update should be %s", record1.RData)

 	// Apply second update
-	resolver.Update(update2)
+	resolver.Update(update2, nil)

 	// Verify second update
 	resolver.mu.RLock()
@@ -154,7 +173,7 @@ func TestLocalResolver_MultipleRecords_SameQuestion(t *testing.T) {
 	update := []nbdns.SimpleRecord{record1, record2}

 	// Apply update with both records
-	resolver.Update(update)
+	resolver.Update(update, nil)

 	// Create question that matches both records
 	question := dns.Question{
@@ -198,7 +217,7 @@ func TestLocalResolver_RecordRotation(t *testing.T) {
 	update := []nbdns.SimpleRecord{record1, record2, record3}

 	// Apply update with all three records
-	resolver.Update(update)
+	resolver.Update(update, nil)

 	msg := new(dns.Msg).SetQuestion(recordName, recordType)

@@ -264,7 +283,7 @@ func TestLocalResolver_CaseInsensitiveMatching(t *testing.T) {
 	}

 	// Update resolver with the records
-	resolver.Update([]nbdns.SimpleRecord{lowerCaseRecord, mixedCaseRecord})
+	resolver.Update([]nbdns.SimpleRecord{lowerCaseRecord, mixedCaseRecord}, nil)

 	testCases := []struct {
 		name          string
@@ -379,7 +398,7 @@ func TestLocalResolver_CNAMEFallback(t *testing.T) {
 	}

 	// Update resolver with both records
-	resolver.Update([]nbdns.SimpleRecord{cnameRecord, targetRecord})
+	resolver.Update([]nbdns.SimpleRecord{cnameRecord, targetRecord}, nil)

 	testCases := []struct {
 		name          string
@@ -476,6 +495,20 @@ func TestLocalResolver_CNAMEFallback(t *testing.T) {
 // with 0 records instead of NXDOMAIN
 func TestLocalResolver_NoErrorWithDifferentRecordType(t *testing.T) {
 	resolver := NewResolver()
+	// Mock external resolver for CNAME target resolution
+	resolver.resolver = &mockResolver{
+		lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
+			if host == "target.example.com." {
+				if network == "ip4" {
+					return []netip.Addr{netip.MustParseAddr("93.184.216.34")}, nil
+				}
+				if network == "ip6" {
+					return []netip.Addr{netip.MustParseAddr("2606:2800:220:1:248:1893:25c8:1946")}, nil
+				}
+			}
+			return nil, &net.DNSError{IsNotFound: true, Name: host}
+		},
+	}

 	recordA := nbdns.SimpleRecord{
 		Name:  "example.netbird.cloud.",
@@ -493,7 +526,7 @@ func TestLocalResolver_NoErrorWithDifferentRecordType(t *testing.T) {
 		RData: "target.example.com.",
 	}

-	resolver.Update([]nbdns.SimpleRecord{recordA, recordCNAME})
+	resolver.Update([]nbdns.SimpleRecord{recordA, recordCNAME}, nil)

 	testCases := []struct {
 		name           string
@@ -582,3 +615,555 @@ func TestLocalResolver_NoErrorWithDifferentRecordType(t *testing.T) {
 		})
 	}
 }
+
+// TestLocalResolver_CNAMEChainResolution tests comprehensive CNAME chain following
+func TestLocalResolver_CNAMEChainResolution(t *testing.T) {
+	t.Run("simple internal CNAME chain", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "alias.example.com.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "target.example.com."},
+			{Name: "target.example.com.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "192.168.1.1"},
+		}, nil)
+
+		msg := new(dns.Msg).SetQuestion("alias.example.com.", dns.TypeA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		require.Equal(t, dns.RcodeSuccess, resp.Rcode)
+		require.Len(t, resp.Answer, 2)
+
+		cname, ok := resp.Answer[0].(*dns.CNAME)
+		require.True(t, ok)
+		assert.Equal(t, "target.example.com.", cname.Target)
+
+		a, ok := resp.Answer[1].(*dns.A)
+		require.True(t, ok)
+		assert.Equal(t, "192.168.1.1", a.A.String())
+	})
+
+	t.Run("multi-hop CNAME chain", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "hop1.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "hop2.test."},
+			{Name: "hop2.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "hop3.test."},
+			{Name: "hop3.test.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
+		}, nil)
+
+		msg := new(dns.Msg).SetQuestion("hop1.test.", dns.TypeA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		require.Equal(t, dns.RcodeSuccess, resp.Rcode)
+		require.Len(t, resp.Answer, 3)
+	})
+
+	t.Run("CNAME to non-existent internal target returns only CNAME", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "alias.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "nonexistent.test."},
+		}, nil)
+
+		msg := new(dns.Msg).SetQuestion("alias.test.", dns.TypeA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		require.Len(t, resp.Answer, 1)
+		_, ok := resp.Answer[0].(*dns.CNAME)
+		assert.True(t, ok)
+	})
+}
+
+// TestLocalResolver_CNAMEMaxDepth tests the maximum depth limit for CNAME chains
+func TestLocalResolver_CNAMEMaxDepth(t *testing.T) {
+	t.Run("chain at max depth resolves", func(t *testing.T) {
+		resolver := NewResolver()
+		var records []nbdns.SimpleRecord
+		// Create chain of 7 CNAMEs (under max of 8)
+		for i := 1; i <= 7; i++ {
+			records = append(records, nbdns.SimpleRecord{
+				Name:  fmt.Sprintf("hop%d.test.", i),
+				Type:  int(dns.TypeCNAME),
+				Class: nbdns.DefaultClass,
+				TTL:   300,
+				RData: fmt.Sprintf("hop%d.test.", i+1),
+			})
+		}
+		records = append(records, nbdns.SimpleRecord{
+			Name: "hop8.test.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.10.10.10",
+		})
+
+		resolver.Update(records, nil)
+
+		msg := new(dns.Msg).SetQuestion("hop1.test.", dns.TypeA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		require.Equal(t, dns.RcodeSuccess, resp.Rcode)
+		require.Len(t, resp.Answer, 8)
+	})
+
+	t.Run("chain exceeding max depth stops", func(t *testing.T) {
+		resolver := NewResolver()
+		var records []nbdns.SimpleRecord
+		// Create chain of 10 CNAMEs (exceeds max of 8)
+		for i := 1; i <= 10; i++ {
+			records = append(records, nbdns.SimpleRecord{
+				Name:  fmt.Sprintf("deep%d.test.", i),
+				Type:  int(dns.TypeCNAME),
+				Class: nbdns.DefaultClass,
+				TTL:   300,
+				RData: fmt.Sprintf("deep%d.test.", i+1),
+			})
+		}
+		records = append(records, nbdns.SimpleRecord{
+			Name: "deep11.test.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.10.10.10",
+		})
+
+		resolver.Update(records, nil)
+
+		msg := new(dns.Msg).SetQuestion("deep1.test.", dns.TypeA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		// Should NOT have the final A record (chain too deep)
+		assert.LessOrEqual(t, len(resp.Answer), 8)
+	})
+
+	t.Run("circular CNAME is protected by max depth", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "loop1.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "loop2.test."},
+			{Name: "loop2.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "loop1.test."},
+		}, nil)
+
+		msg := new(dns.Msg).SetQuestion("loop1.test.", dns.TypeA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		assert.LessOrEqual(t, len(resp.Answer), 8)
+	})
+}
+
+// TestLocalResolver_ExternalCNAMEResolution tests CNAME resolution to external domains
+func TestLocalResolver_ExternalCNAMEResolution(t *testing.T) {
+	t.Run("CNAME to external domain resolves via external resolver", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.resolver = &mockResolver{
+			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
+				if host == "external.example.com." && network == "ip4" {
+					return []netip.Addr{netip.MustParseAddr("93.184.216.34")}, nil
+				}
+				return nil, nil
+			},
+		}
+
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "alias.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.example.com."},
+		}, nil)
+
+		msg := new(dns.Msg).SetQuestion("alias.test.", dns.TypeA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		require.Len(t, resp.Answer, 2, "Should have CNAME + A record")
+
+		cname, ok := resp.Answer[0].(*dns.CNAME)
+		require.True(t, ok)
+		assert.Equal(t, "external.example.com.", cname.Target)
+
+		a, ok := resp.Answer[1].(*dns.A)
+		require.True(t, ok)
+		assert.Equal(t, "93.184.216.34", a.A.String())
+	})
+
+	t.Run("CNAME to external domain resolves IPv6", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.resolver = &mockResolver{
+			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
+				if host == "external.example.com." && network == "ip6" {
+					return []netip.Addr{netip.MustParseAddr("2606:2800:220:1:248:1893:25c8:1946")}, nil
+				}
+				return nil, nil
+			},
+		}
+
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "alias.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.example.com."},
+		}, nil)
+
+		msg := new(dns.Msg).SetQuestion("alias.test.", dns.TypeAAAA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		require.Len(t, resp.Answer, 2, "Should have CNAME + AAAA record")
+
+		cname, ok := resp.Answer[0].(*dns.CNAME)
+		require.True(t, ok)
+		assert.Equal(t, "external.example.com.", cname.Target)
+
+		aaaa, ok := resp.Answer[1].(*dns.AAAA)
+		require.True(t, ok)
+		assert.Equal(t, "2606:2800:220:1:248:1893:25c8:1946", aaaa.AAAA.String())
+	})
+
+	t.Run("concurrent external resolution", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.resolver = &mockResolver{
+			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
+				if host == "external.example.com." && network == "ip4" {
+					return []netip.Addr{netip.MustParseAddr("93.184.216.34")}, nil
+				}
+				return nil, nil
+			},
+		}
+
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "concurrent.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.example.com."},
+		}, nil)
+
+		var wg sync.WaitGroup
+		results := make([]*dns.Msg, 10)
+
+		for i := 0; i < 10; i++ {
+			wg.Add(1)
+			go func(idx int) {
+				defer wg.Done()
+				msg := new(dns.Msg).SetQuestion("concurrent.test.", dns.TypeA)
+				var resp *dns.Msg
+				resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+				results[idx] = resp
+			}(i)
+		}
+		wg.Wait()
+
+		for i, resp := range results {
+			require.NotNil(t, resp, "Response %d should not be nil", i)
+			require.Len(t, resp.Answer, 2, "Response %d should have CNAME + A", i)
+		}
+	})
+}
+
+// TestLocalResolver_ZoneManagement tests zone-aware CNAME resolution
+func TestLocalResolver_ZoneManagement(t *testing.T) {
+	t.Run("Update sets zones correctly", func(t *testing.T) {
+		resolver := NewResolver()
+
+		zones := []domain.Domain{"example.com", "test.local"}
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "host.example.com.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
+		}, zones)
+
+		assert.True(t, resolver.isInManagedZone("host.example.com."))
+		assert.True(t, resolver.isInManagedZone("other.example.com."))
+		assert.True(t, resolver.isInManagedZone("sub.test.local."))
+		assert.False(t, resolver.isInManagedZone("external.com."))
+	})
+
+	t.Run("isInManagedZone case insensitive", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.Update(nil, []domain.Domain{"Example.COM"})
+
+		assert.True(t, resolver.isInManagedZone("host.example.com."))
+		assert.True(t, resolver.isInManagedZone("HOST.EXAMPLE.COM."))
+	})
+
+	t.Run("Update clears zones", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.Update(nil, []domain.Domain{"example.com"})
+		assert.True(t, resolver.isInManagedZone("host.example.com."))
+
+		resolver.Update(nil, nil)
+		assert.False(t, resolver.isInManagedZone("host.example.com."))
+	})
+}
+
+// TestLocalResolver_CNAMEZoneAwareResolution tests CNAME resolution with zone awareness
+func TestLocalResolver_CNAMEZoneAwareResolution(t *testing.T) {
+	t.Run("CNAME target in managed zone returns NXDOMAIN per RFC 6604", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "alias.myzone.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "nonexistent.myzone.test."},
+		}, []domain.Domain{"myzone.test"})
+
+		msg := new(dns.Msg).SetQuestion("alias.myzone.test.", dns.TypeA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		assert.Equal(t, dns.RcodeNameError, resp.Rcode, "Should return NXDOMAIN")
+		require.Len(t, resp.Answer, 1, "Should include CNAME in answer")
+	})
+
+	t.Run("CNAME to external domain skips zone check", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.resolver = &mockResolver{
+			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
+				if host == "external.other.com." && network == "ip4" {
+					return []netip.Addr{netip.MustParseAddr("203.0.113.1")}, nil
+				}
+				return nil, nil
+			},
+		}
+
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "alias.myzone.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.other.com."},
+		}, []domain.Domain{"myzone.test"})
+
+		msg := new(dns.Msg).SetQuestion("alias.myzone.test.", dns.TypeA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		assert.Equal(t, dns.RcodeSuccess, resp.Rcode)
+		require.Len(t, resp.Answer, 2, "Should have CNAME + A from external resolution")
+	})
+
+	t.Run("CNAME target exists with different type returns NODATA not NXDOMAIN", func(t *testing.T) {
+		resolver := NewResolver()
+		// CNAME points to target that has A but no AAAA - query for AAAA should be NODATA
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "alias.myzone.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "target.myzone.test."},
+			{Name: "target.myzone.test.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "1.1.1.1"},
+		}, []domain.Domain{"myzone.test"})
+
+		msg := new(dns.Msg).SetQuestion("alias.myzone.test.", dns.TypeAAAA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		assert.Equal(t, dns.RcodeSuccess, resp.Rcode, "Should return NODATA (success), not NXDOMAIN")
+		require.Len(t, resp.Answer, 1, "Should have only CNAME, no AAAA")
+		_, ok := resp.Answer[0].(*dns.CNAME)
+		assert.True(t, ok, "Answer should be CNAME record")
+	})
+
+	t.Run("external CNAME target exists but no AAAA records (NODATA)", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.resolver = &mockResolver{
+			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
+				if host == "external.example.com." {
+					if network == "ip6" {
+						// No AAAA records
+						return nil, &net.DNSError{IsNotFound: true, Name: host}
+					}
+					if network == "ip4" {
+						// But A records exist - domain exists
+						return []netip.Addr{netip.MustParseAddr("93.184.216.34")}, nil
+					}
+				}
+				return nil, &net.DNSError{IsNotFound: true, Name: host}
+			},
+		}
+
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "alias.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.example.com."},
+		}, nil)
+
+		msg := new(dns.Msg).SetQuestion("alias.test.", dns.TypeAAAA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		assert.Equal(t, dns.RcodeSuccess, resp.Rcode, "Should return NODATA (success), not NXDOMAIN")
+		require.Len(t, resp.Answer, 1, "Should have only CNAME")
+		_, ok := resp.Answer[0].(*dns.CNAME)
+		assert.True(t, ok, "Answer should be CNAME record")
+	})
+
+	// Table-driven test for all external resolution outcomes
+	externalCases := []struct {
+		name           string
+		lookupFunc     func(context.Context, string, string) ([]netip.Addr, error)
+		expectedRcode  int
+		expectedAnswer int
+	}{
+		{
+			name: "external NXDOMAIN (both A and AAAA not found)",
+			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
+				return nil, &net.DNSError{IsNotFound: true, Name: host}
+			},
+			expectedRcode:  dns.RcodeNameError,
+			expectedAnswer: 1, // CNAME only
+		},
+		{
+			name: "external SERVFAIL (temporary error)",
+			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
+				return nil, &net.DNSError{IsTemporary: true, Name: host}
+			},
+			expectedRcode:  dns.RcodeServerFailure,
+			expectedAnswer: 1, // CNAME only
+		},
+		{
+			name: "external SERVFAIL (timeout)",
+			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
+				return nil, &net.DNSError{IsTimeout: true, Name: host}
+			},
+			expectedRcode:  dns.RcodeServerFailure,
+			expectedAnswer: 1, // CNAME only
+		},
+		{
+			name: "external SERVFAIL (generic error)",
+			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
+				return nil, fmt.Errorf("connection refused")
+			},
+			expectedRcode:  dns.RcodeServerFailure,
+			expectedAnswer: 1, // CNAME only
+		},
+		{
+			name: "external success with IPs",
+			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
+				if network == "ip4" {
+					return []netip.Addr{netip.MustParseAddr("93.184.216.34")}, nil
+				}
+				return nil, &net.DNSError{IsNotFound: true, Name: host}
+			},
+			expectedRcode:  dns.RcodeSuccess,
+			expectedAnswer: 2, // CNAME + A
+		},
+	}
+
+	for _, tc := range externalCases {
+		t.Run(tc.name, func(t *testing.T) {
+			resolver := NewResolver()
+			resolver.resolver = &mockResolver{lookupFunc: tc.lookupFunc}
+
+			resolver.Update([]nbdns.SimpleRecord{
+				{Name: "alias.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.example.com."},
+			}, nil)
+
+			msg := new(dns.Msg).SetQuestion("alias.test.", dns.TypeA)
+			var resp *dns.Msg
+			resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+			require.NotNil(t, resp)
+			assert.Equal(t, tc.expectedRcode, resp.Rcode, "rcode mismatch")
+			assert.Len(t, resp.Answer, tc.expectedAnswer, "answer count mismatch")
+			if tc.expectedAnswer > 0 {
+				_, ok := resp.Answer[0].(*dns.CNAME)
+				assert.True(t, ok, "first answer should be CNAME")
+			}
+		})
+	}
+}
+
+// TestLocalResolver_AuthoritativeFlag tests the AA flag behavior
+func TestLocalResolver_AuthoritativeFlag(t *testing.T) {
+	t.Run("direct record lookup is authoritative", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "host.example.com.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
+		}, []domain.Domain{"example.com"})
+
+		msg := new(dns.Msg).SetQuestion("host.example.com.", dns.TypeA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		assert.True(t, resp.Authoritative)
+	})
+
+	t.Run("external resolution is not authoritative", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.resolver = &mockResolver{
+			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
+				if host == "external.example.com." && network == "ip4" {
+					return []netip.Addr{netip.MustParseAddr("93.184.216.34")}, nil
+				}
+				return nil, nil
+			},
+		}
+
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "alias.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.example.com."},
+		}, nil)
+
+		msg := new(dns.Msg).SetQuestion("alias.test.", dns.TypeA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		require.Len(t, resp.Answer, 2)
+		assert.False(t, resp.Authoritative)
+	})
+}
+
+// TestLocalResolver_Stop tests cleanup on Stop
+func TestLocalResolver_Stop(t *testing.T) {
+	t.Run("Stop clears all state", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "host.example.com.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
+		}, []domain.Domain{"example.com"})
+
+		resolver.Stop()
+
+		msg := new(dns.Msg).SetQuestion("host.example.com.", dns.TypeA)
+		var resp *dns.Msg
+		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
+
+		require.NotNil(t, resp)
+		assert.Len(t, resp.Answer, 0)
+		assert.False(t, resolver.isInManagedZone("host.example.com."))
+	})
+
+	t.Run("Stop is safe to call multiple times", func(t *testing.T) {
+		resolver := NewResolver()
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "host.example.com.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
+		}, []domain.Domain{"example.com"})
+
+		resolver.Stop()
+		resolver.Stop()
+		resolver.Stop()
+	})
+
+	t.Run("Stop cancels in-flight external resolution", func(t *testing.T) {
+		resolver := NewResolver()
+
+		lookupStarted := make(chan struct{})
+		lookupCtxCanceled := make(chan struct{})
+
+		resolver.resolver = &mockResolver{
+			lookupFunc: func(ctx context.Context, network, host string) ([]netip.Addr, error) {
+				close(lookupStarted)
+				<-ctx.Done()
+				close(lookupCtxCanceled)
+				return nil, ctx.Err()
+			},
+		}
+
+		resolver.Update([]nbdns.SimpleRecord{
+			{Name: "alias.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.example.com."},
+		}, nil)
+
+		done := make(chan struct{})
+		go func() {
+			msg := new(dns.Msg).SetQuestion("alias.test.", dns.TypeA)
+			resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { return nil }}, msg)
+			close(done)
+		}()
+
+		<-lookupStarted
+		resolver.Stop()
+
+		select {
+		case <-lookupCtxCanceled:
+		case <-time.After(time.Second):
+			t.Fatal("external lookup context was not canceled")
+		}
+
+		select {
+		case <-done:
+		case <-time.After(time.Second):
+			t.Fatal("ServeDNS did not return after Stop")
+		}
+	})
+}