Add ServeDNS test for non-retryable EDE short-circuit and OPT stripping

.github/workflows/golangci-lint.yml

@@ -19,7 +19,7 @@ jobs:
       - name: codespell
         uses: codespell-project/actions-codespell@v2
         with:
-          ignore_words_list: erro,clienta,hastable,iif,groupd,testin,groupe,cros,ans,deriver,te,userA
+          ignore_words_list: erro,clienta,hastable,iif,groupd,testin,groupe,cros,ans,deriver,te,userA,ede,additionals
           skip: go.mod,go.sum,**/proxy/web/**
   golangci:
     strategy:

client/internal/connect.go

@@ -113,6 +113,7 @@ func (c *ConnectClient) RunOniOS(
 	fileDescriptor int32,
 	networkChangeListener listener.NetworkChangeListener,
 	dnsManager dns.IosDnsManager,
+	dnsAddresses []netip.AddrPort,
 	stateFilePath string,
 ) error {
 	// Set GC percent to 5% to reduce memory usage as iOS only allows 50MB of memory for the extension.
@@ -122,6 +123,7 @@ func (c *ConnectClient) RunOniOS(
 		FileDescriptor:        fileDescriptor,
 		NetworkChangeListener: networkChangeListener,
 		DnsManager:            dnsManager,
+		HostDNSAddresses:      dnsAddresses,
 		StateFilePath:         stateFilePath,
 	}
 	return c.run(mobileDependency, nil, "")

client/internal/dns/host.go

@@ -16,10 +16,6 @@ type hostManager interface {
 	restoreHostDNS() error
 	supportCustomPort() bool
 	string() string
-	// getOriginalNameservers returns the OS-side resolvers used as PriorityFallback
-	// upstreams: pre-takeover snapshots on desktop, the OS-pushed list on Android,
-	// hardcoded Quad9 on iOS, nil for noop / mock.
-	getOriginalNameservers() []netip.Addr
 }
 
 type SystemDNSSettings struct {
@@ -135,11 +131,3 @@ func (n noopHostConfigurator) supportCustomPort() bool {
 func (n noopHostConfigurator) string() string {
 	return "noop"
 }
-
-func (n noopHostConfigurator) getOriginalNameservers() []netip.Addr {
-	return nil
-}
-
-func (m *mockHostConfigurator) getOriginalNameservers() []netip.Addr {
-	return nil
-}

client/internal/dns/host_android.go

@@ -1,43 +1,28 @@
 package dns
 
 import (
-	"net/netip"
-
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 )
 
-// androidHostManager is a noop on the OS side (Android's VPN service handles
-// DNS for us) but tracks the OS-reported resolver list pushed via
-// OnUpdatedHostDNSServer so it can serve as the fallback nameserver source.
 type androidHostManager struct {
-	holder *hostsDNSHolder
 }
 
-func newHostManager(holder *hostsDNSHolder) (*androidHostManager, error) {
-	return &androidHostManager{holder: holder}, nil
+func newHostManager() (*androidHostManager, error) {
+	return &androidHostManager{}, nil
 }
 
-func (a *androidHostManager) applyDNSConfig(HostDNSConfig, *statemanager.Manager) error {
+func (a androidHostManager) applyDNSConfig(HostDNSConfig, *statemanager.Manager) error {
 	return nil
 }
 
-func (a *androidHostManager) restoreHostDNS() error {
+func (a androidHostManager) restoreHostDNS() error {
 	return nil
 }
 
-func (a *androidHostManager) supportCustomPort() bool {
+func (a androidHostManager) supportCustomPort() bool {
 	return false
 }
 
-func (a *androidHostManager) string() string {
+func (a androidHostManager) string() string {
 	return "none"
 }
-
-func (a *androidHostManager) getOriginalNameservers() []netip.Addr {
-	hosts := a.holder.get()
-	out := make([]netip.Addr, 0, len(hosts))
-	for ap := range hosts {
-		out = append(out, ap.Addr())
-	}
-	return out
-}

client/internal/dns/host_ios.go

@@ -3,7 +3,6 @@ package dns
 import (
 	"encoding/json"
 	"fmt"
-	"net/netip"
 
 	log "github.com/sirupsen/logrus"
 
@@ -15,14 +14,6 @@ type iosHostManager struct {
 	config     HostDNSConfig
 }
 
-func (a iosHostManager) getOriginalNameservers() []netip.Addr {
-	// Quad9 v4+v6: 9.9.9.9, 2620:fe::fe.
-	return []netip.Addr{
-		netip.AddrFrom4([4]byte{9, 9, 9, 9}),
-		netip.AddrFrom16([16]byte{0x26, 0x20, 0x00, 0xfe, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xfe}),
-	}
-}
-
 func newHostManager(dnsManager IosDnsManager) (*iosHostManager, error) {
 	return &iosHostManager{
 		dnsManager: dnsManager,

client/internal/dns/host_windows.go

@@ -7,7 +7,6 @@ import (
 	"io"
 	"net/netip"
 	"os/exec"
-	"slices"
 	"strings"
 	"syscall"
 	"time"
@@ -45,11 +44,9 @@ const (
 
 	nrptMaxDomainsPerRule = 50
 
-	interfaceConfigPath           = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces`
-	interfaceConfigPathV6         = `SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces`
-	interfaceConfigNameServerKey  = "NameServer"
-	interfaceConfigDhcpNameSrvKey = "DhcpNameServer"
-	interfaceConfigSearchListKey  = "SearchList"
+	interfaceConfigPath          = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces`
+	interfaceConfigNameServerKey = "NameServer"
+	interfaceConfigSearchListKey = "SearchList"
 
 	// Network interface DNS registration settings
 	disableDynamicUpdateKey           = "DisableDynamicUpdate"
@@ -70,11 +67,10 @@ const (
 )
 
 type registryConfigurator struct {
-	guid            string
-	routingAll      bool
-	gpo             bool
-	nrptEntryCount  int
-	origNameservers []netip.Addr
+	guid           string
+	routingAll     bool
+	gpo            bool
+	nrptEntryCount int
 }
 
 func newHostManager(wgInterface WGIface) (*registryConfigurator, error) {
@@ -98,17 +94,6 @@ func newHostManager(wgInterface WGIface) (*registryConfigurator, error) {
 		gpo:  useGPO,
 	}
 
-	origNameservers, err := configurator.captureOriginalNameservers()
-	switch {
-	case err != nil:
-		log.Warnf("capture original nameservers from non-WG adapters: %v", err)
-	case len(origNameservers) == 0:
-		log.Warnf("no original nameservers captured from non-WG adapters; DNS fallback will be empty")
-	default:
-		log.Debugf("captured %d original nameservers from non-WG adapters: %v", len(origNameservers), origNameservers)
-	}
-	configurator.origNameservers = origNameservers
-
 	if err := configurator.configureInterface(); err != nil {
 		log.Errorf("failed to configure interface settings: %v", err)
 	}
@@ -116,98 +101,6 @@ func newHostManager(wgInterface WGIface) (*registryConfigurator, error) {
 	return configurator, nil
 }
 
-// captureOriginalNameservers reads DNS addresses from every Tcpip(6) interface
-// registry key except the WG adapter. v4 and v6 servers live in separate
-// hives (Tcpip vs Tcpip6) keyed by the same interface GUID.
-func (r *registryConfigurator) captureOriginalNameservers() ([]netip.Addr, error) {
-	seen := make(map[netip.Addr]struct{})
-	var out []netip.Addr
-	var merr *multierror.Error
-	for _, root := range []string{interfaceConfigPath, interfaceConfigPathV6} {
-		addrs, err := r.captureFromTcpipRoot(root)
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("%s: %w", root, err))
-			continue
-		}
-		for _, addr := range addrs {
-			if _, dup := seen[addr]; dup {
-				continue
-			}
-			seen[addr] = struct{}{}
-			out = append(out, addr)
-		}
-	}
-	return out, nberrors.FormatErrorOrNil(merr)
-}
-
-func (r *registryConfigurator) captureFromTcpipRoot(rootPath string) ([]netip.Addr, error) {
-	root, err := registry.OpenKey(registry.LOCAL_MACHINE, rootPath, registry.READ)
-	if err != nil {
-		return nil, fmt.Errorf("open key: %w", err)
-	}
-	defer closer(root)
-
-	guids, err := root.ReadSubKeyNames(-1)
-	if err != nil {
-		return nil, fmt.Errorf("read subkeys: %w", err)
-	}
-
-	var out []netip.Addr
-	for _, guid := range guids {
-		if strings.EqualFold(guid, r.guid) {
-			continue
-		}
-		out = append(out, readInterfaceNameservers(rootPath, guid)...)
-	}
-	return out, nil
-}
-
-func readInterfaceNameservers(rootPath, guid string) []netip.Addr {
-	keyPath := rootPath + "\\" + guid
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, keyPath, registry.QUERY_VALUE)
-	if err != nil {
-		return nil
-	}
-	defer closer(k)
-
-	// Static NameServer wins over DhcpNameServer for actual resolution.
-	for _, name := range []string{interfaceConfigNameServerKey, interfaceConfigDhcpNameSrvKey} {
-		raw, _, err := k.GetStringValue(name)
-		if err != nil || raw == "" {
-			continue
-		}
-		if out := parseRegistryNameservers(raw); len(out) > 0 {
-			return out
-		}
-	}
-	return nil
-}
-
-func parseRegistryNameservers(raw string) []netip.Addr {
-	var out []netip.Addr
-	for _, field := range strings.FieldsFunc(raw, func(r rune) bool { return r == ',' || r == ' ' || r == '\t' }) {
-		addr, err := netip.ParseAddr(strings.TrimSpace(field))
-		if err != nil {
-			continue
-		}
-		addr = addr.Unmap()
-		if !addr.IsValid() || addr.IsUnspecified() {
-			continue
-		}
-		// Drop unzoned link-local: not routable without a scope id. If
-		// the user wrote "fe80::1%eth0" ParseAddr preserves the zone.
-		if addr.IsLinkLocalUnicast() && addr.Zone() == "" {
-			continue
-		}
-		out = append(out, addr)
-	}
-	return out
-}
-
-func (r *registryConfigurator) getOriginalNameservers() []netip.Addr {
-	return slices.Clone(r.origNameservers)
-}
-
 func (r *registryConfigurator) supportCustomPort() bool {
 	return false
 }

client/internal/dns/hosts_dns_holder.go

@@ -25,7 +25,6 @@ func (h *hostsDNSHolder) set(list []netip.AddrPort) {
 	h.mutex.Unlock()
 }
 
-//nolint:unused
 func (h *hostsDNSHolder) get() map[netip.AddrPort]struct{} {
 	h.mutex.RLock()
 	l := h.unprotectedDNSList

client/internal/dns/local/local.go

@@ -77,6 +77,8 @@ func (d *Resolver) ID() types.HandlerID {
 	return "local-resolver"
 }
 
+func (d *Resolver) ProbeAvailability(context.Context) {}
+
 // ServeDNS handles a DNS request
 func (d *Resolver) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 	logger := log.WithFields(log.Fields{

client/internal/dns/mock_server.go

@@ -9,7 +9,6 @@ import (
 
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
 	nbdns "github.com/netbirdio/netbird/dns"
-	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
@@ -71,6 +70,10 @@ func (m *MockServer) SearchDomains() []string {
 	return make([]string, 0)
 }
 
+// ProbeAvailability mocks implementation of ProbeAvailability from the Server interface
+func (m *MockServer) ProbeAvailability() {
+}
+
 func (m *MockServer) UpdateServerConfig(domains dnsconfig.ServerDomains) error {
 	if m.UpdateServerConfigFunc != nil {
 		return m.UpdateServerConfigFunc(domains)
@@ -82,8 +85,8 @@ func (m *MockServer) PopulateManagementDomain(mgmtURL *url.URL) error {
 	return nil
 }
 
-// SetRouteSources mock implementation of SetRouteSources from Server interface
-func (m *MockServer) SetRouteSources(selected, active func() route.HAMap) {
+// SetRouteChecker mock implementation of SetRouteChecker from Server interface
+func (m *MockServer) SetRouteChecker(func(netip.Addr) bool) {
 	// Mock implementation - no-op
 }
 

client/internal/dns/network_manager_unix.go

@@ -8,7 +8,6 @@ import (
 	"errors"
 	"fmt"
 	"net/netip"
-	"slices"
 	"strings"
 	"time"
 
@@ -33,15 +32,6 @@ const (
 	networkManagerDbusDeviceGetAppliedConnectionMethod                              = networkManagerDbusDeviceInterface + ".GetAppliedConnection"
 	networkManagerDbusDeviceReapplyMethod                                           = networkManagerDbusDeviceInterface + ".Reapply"
 	networkManagerDbusDeviceDeleteMethod                                            = networkManagerDbusDeviceInterface + ".Delete"
-	networkManagerDbusDeviceIp4ConfigProperty                                       = networkManagerDbusDeviceInterface + ".Ip4Config"
-	networkManagerDbusDeviceIp6ConfigProperty                                       = networkManagerDbusDeviceInterface + ".Ip6Config"
-	networkManagerDbusDeviceIfaceProperty                                           = networkManagerDbusDeviceInterface + ".Interface"
-	networkManagerDbusGetDevicesMethod                                              = networkManagerDest + ".GetDevices"
-	networkManagerDbusIp4ConfigInterface                                            = "org.freedesktop.NetworkManager.IP4Config"
-	networkManagerDbusIp6ConfigInterface                                            = "org.freedesktop.NetworkManager.IP6Config"
-	networkManagerDbusIp4ConfigNameserverDataProperty                               = networkManagerDbusIp4ConfigInterface + ".NameserverData"
-	networkManagerDbusIp4ConfigNameserversProperty                                  = networkManagerDbusIp4ConfigInterface + ".Nameservers"
-	networkManagerDbusIp6ConfigNameserversProperty                                  = networkManagerDbusIp6ConfigInterface + ".Nameservers"
 	networkManagerDbusDefaultBehaviorFlag              networkManagerConfigBehavior = 0
 	networkManagerDbusIPv4Key                                                       = "ipv4"
 	networkManagerDbusIPv6Key                                                       = "ipv6"
@@ -61,10 +51,9 @@ var supportedNetworkManagerVersionConstraints = []string{
 }
 
 type networkManagerDbusConfigurator struct {
-	dbusLinkObject  dbus.ObjectPath
-	routingAll      bool
-	ifaceName       string
-	origNameservers []netip.Addr
+	dbusLinkObject dbus.ObjectPath
+	routingAll     bool
+	ifaceName      string
 }
 
 // the types below are based on dbus specification, each field is mapped to a dbus type
@@ -103,200 +92,10 @@ func newNetworkManagerDbusConfigurator(wgInterface string) (*networkManagerDbusC
 
 	log.Debugf("got network manager dbus Link Object: %s from net interface %s", s, wgInterface)
 
-	c := &networkManagerDbusConfigurator{
+	return &networkManagerDbusConfigurator{
 		dbusLinkObject: dbus.ObjectPath(s),
 		ifaceName:      wgInterface,
-	}
-
-	origNameservers, err := c.captureOriginalNameservers()
-	switch {
-	case err != nil:
-		log.Warnf("capture original nameservers from NetworkManager: %v", err)
-	case len(origNameservers) == 0:
-		log.Warnf("no original nameservers captured from non-WG NetworkManager devices; DNS fallback will be empty")
-	default:
-		log.Debugf("captured %d original nameservers from non-WG NetworkManager devices: %v", len(origNameservers), origNameservers)
-	}
-	c.origNameservers = origNameservers
-	return c, nil
-}
-
-// captureOriginalNameservers reads DNS servers from every NM device's
-// IP4Config / IP6Config except our WG device.
-func (n *networkManagerDbusConfigurator) captureOriginalNameservers() ([]netip.Addr, error) {
-	devices, err := networkManagerListDevices()
-	if err != nil {
-		return nil, fmt.Errorf("list devices: %w", err)
-	}
-
-	seen := make(map[netip.Addr]struct{})
-	var out []netip.Addr
-	for _, dev := range devices {
-		if dev == n.dbusLinkObject {
-			continue
-		}
-		ifaceName := readNetworkManagerDeviceInterface(dev)
-		for _, addr := range readNetworkManagerDeviceDNS(dev) {
-			addr = addr.Unmap()
-			if !addr.IsValid() || addr.IsUnspecified() {
-				continue
-			}
-			// IP6Config.Nameservers is a byte slice without zone info;
-			// reattach the device's interface name so a captured fe80::…
-			// stays routable.
-			if addr.IsLinkLocalUnicast() && ifaceName != "" {
-				addr = addr.WithZone(ifaceName)
-			}
-			if _, dup := seen[addr]; dup {
-				continue
-			}
-			seen[addr] = struct{}{}
-			out = append(out, addr)
-		}
-	}
-	return out, nil
-}
-
-func readNetworkManagerDeviceInterface(devicePath dbus.ObjectPath) string {
-	obj, closeConn, err := getDbusObject(networkManagerDest, devicePath)
-	if err != nil {
-		return ""
-	}
-	defer closeConn()
-	v, err := obj.GetProperty(networkManagerDbusDeviceIfaceProperty)
-	if err != nil {
-		return ""
-	}
-	s, _ := v.Value().(string)
-	return s
-}
-
-func networkManagerListDevices() ([]dbus.ObjectPath, error) {
-	obj, closeConn, err := getDbusObject(networkManagerDest, networkManagerDbusObjectNode)
-	if err != nil {
-		return nil, fmt.Errorf("dbus NetworkManager: %w", err)
-	}
-	defer closeConn()
-	var devs []dbus.ObjectPath
-	if err := obj.Call(networkManagerDbusGetDevicesMethod, dbusDefaultFlag).Store(&devs); err != nil {
-		return nil, err
-	}
-	return devs, nil
-}
-
-func readNetworkManagerDeviceDNS(devicePath dbus.ObjectPath) []netip.Addr {
-	obj, closeConn, err := getDbusObject(networkManagerDest, devicePath)
-	if err != nil {
-		return nil
-	}
-	defer closeConn()
-
-	var out []netip.Addr
-	if path := readNetworkManagerConfigPath(obj, networkManagerDbusDeviceIp4ConfigProperty); path != "" {
-		out = append(out, readIPv4ConfigDNS(path)...)
-	}
-	if path := readNetworkManagerConfigPath(obj, networkManagerDbusDeviceIp6ConfigProperty); path != "" {
-		out = append(out, readIPv6ConfigDNS(path)...)
-	}
-	return out
-}
-
-func readNetworkManagerConfigPath(obj dbus.BusObject, property string) dbus.ObjectPath {
-	v, err := obj.GetProperty(property)
-	if err != nil {
-		return ""
-	}
-	path, ok := v.Value().(dbus.ObjectPath)
-	if !ok || path == "/" {
-		return ""
-	}
-	return path
-}
-
-func readIPv4ConfigDNS(path dbus.ObjectPath) []netip.Addr {
-	obj, closeConn, err := getDbusObject(networkManagerDest, path)
-	if err != nil {
-		return nil
-	}
-	defer closeConn()
-
-	// NameserverData (NM 1.13+) carries strings; older NMs only expose the
-	// legacy uint32 Nameservers property.
-	if out := readIPv4NameserverData(obj); len(out) > 0 {
-		return out
-	}
-	return readIPv4LegacyNameservers(obj)
-}
-
-func readIPv4NameserverData(obj dbus.BusObject) []netip.Addr {
-	v, err := obj.GetProperty(networkManagerDbusIp4ConfigNameserverDataProperty)
-	if err != nil {
-		return nil
-	}
-	entries, ok := v.Value().([]map[string]dbus.Variant)
-	if !ok {
-		return nil
-	}
-	var out []netip.Addr
-	for _, entry := range entries {
-		addrVar, ok := entry["address"]
-		if !ok {
-			continue
-		}
-		s, ok := addrVar.Value().(string)
-		if !ok {
-			continue
-		}
-		if a, err := netip.ParseAddr(s); err == nil {
-			out = append(out, a)
-		}
-	}
-	return out
-}
-
-func readIPv4LegacyNameservers(obj dbus.BusObject) []netip.Addr {
-	v, err := obj.GetProperty(networkManagerDbusIp4ConfigNameserversProperty)
-	if err != nil {
-		return nil
-	}
-	raw, ok := v.Value().([]uint32)
-	if !ok {
-		return nil
-	}
-	out := make([]netip.Addr, 0, len(raw))
-	for _, n := range raw {
-		var b [4]byte
-		binary.LittleEndian.PutUint32(b[:], n)
-		out = append(out, netip.AddrFrom4(b))
-	}
-	return out
-}
-
-func readIPv6ConfigDNS(path dbus.ObjectPath) []netip.Addr {
-	obj, closeConn, err := getDbusObject(networkManagerDest, path)
-	if err != nil {
-		return nil
-	}
-	defer closeConn()
-	v, err := obj.GetProperty(networkManagerDbusIp6ConfigNameserversProperty)
-	if err != nil {
-		return nil
-	}
-	raw, ok := v.Value().([][]byte)
-	if !ok {
-		return nil
-	}
-	out := make([]netip.Addr, 0, len(raw))
-	for _, b := range raw {
-		if a, ok := netip.AddrFromSlice(b); ok {
-			out = append(out, a)
-		}
-	}
-	return out
-}
-
-func (n *networkManagerDbusConfigurator) getOriginalNameservers() []netip.Addr {
-	return slices.Clone(n.origNameservers)
+	}, nil
 }
 
 func (n *networkManagerDbusConfigurator) supportCustomPort() bool {

client/internal/dns/server_android.go

@@ -1,5 +1,5 @@
 package dns
 
 func (s *DefaultServer) initialize() (manager hostManager, err error) {
-	return newHostManager(s.hostsDNSHolder)
+	return newHostManager()
 }

client/internal/dns/server_test.go

@@ -6,7 +6,7 @@ import (
 	"net"
 	"net/netip"
 	"os"
-	"runtime"
+	"strings"
 	"testing"
 	"time"
 
@@ -15,7 +15,6 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
 	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
@@ -32,10 +31,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
-	"github.com/netbirdio/netbird/client/proto"
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/formatter"
-	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
@@ -104,17 +101,16 @@ func init() {
 	formatter.SetTextFormatter(log.StandardLogger())
 }
 
-func generateDummyHandler(d string, servers []nbdns.NameServer) *upstreamResolverBase {
+func generateDummyHandler(domain string, servers []nbdns.NameServer) *upstreamResolverBase {
 	var srvs []netip.AddrPort
 	for _, srv := range servers {
 		srvs = append(srvs, srv.AddrPort())
 	}
-	u := &upstreamResolverBase{
-		domain: domain.Domain(d),
-		cancel: func() {},
+	return &upstreamResolverBase{
+		domain:          domain,
+		upstreamServers: srvs,
+		cancel:          func() {},
 	}
-	u.addRace(srvs)
-	return u
 }
 
 func TestUpdateDNSServer(t *testing.T) {
@@ -657,8 +653,74 @@ func TestDNSServerStartStop(t *testing.T) {
 	}
 }
 
+func TestDNSServerUpstreamDeactivateCallback(t *testing.T) {
+	hostManager := &mockHostConfigurator{}
+	server := DefaultServer{
+		ctx:           context.Background(),
+		service:       NewServiceViaMemory(&mocWGIface{}),
+		localResolver: local.NewResolver(),
+		handlerChain:  NewHandlerChain(),
+		hostManager:   hostManager,
+		currentConfig: HostDNSConfig{
+			Domains: []DomainConfig{
+				{false, "domain0", false},
+				{false, "domain1", false},
+				{false, "domain2", false},
+			},
+		},
+		statusRecorder: peer.NewRecorder("mgm"),
+	}
+
+	var domainsUpdate string
+	hostManager.applyDNSConfigFunc = func(config HostDNSConfig, statemanager *statemanager.Manager) error {
+		domains := []string{}
+		for _, item := range config.Domains {
+			if item.Disabled {
+				continue
+			}
+			domains = append(domains, item.Domain)
+		}
+		domainsUpdate = strings.Join(domains, ",")
+		return nil
+	}
+
+	deactivate, reactivate := server.upstreamCallbacks(&nbdns.NameServerGroup{
+		Domains: []string{"domain1"},
+		NameServers: []nbdns.NameServer{
+			{IP: netip.MustParseAddr("8.8.0.0"), NSType: nbdns.UDPNameServerType, Port: 53},
+		},
+	}, nil, 0)
+
+	deactivate(nil)
+	expected := "domain0,domain2"
+	domains := []string{}
+	for _, item := range server.currentConfig.Domains {
+		if item.Disabled {
+			continue
+		}
+		domains = append(domains, item.Domain)
+	}
+	got := strings.Join(domains, ",")
+	if expected != got {
+		t.Errorf("expected domains list: %q, got %q", expected, got)
+	}
+
+	reactivate()
+	expected = "domain0,domain1,domain2"
+	domains = []string{}
+	for _, item := range server.currentConfig.Domains {
+		if item.Disabled {
+			continue
+		}
+		domains = append(domains, item.Domain)
+	}
+	got = strings.Join(domains, ",")
+	if expected != got {
+		t.Errorf("expected domains list: %q, got %q", expected, domainsUpdate)
+	}
+}
+
 func TestDNSPermanent_updateHostDNS_emptyUpstream(t *testing.T) {
-	skipUnlessAndroid(t)
 	wgIFace, err := createWgInterfaceWithBind(t)
 	if err != nil {
 		t.Fatal("failed to initialize wg interface")
@@ -686,7 +748,6 @@ func TestDNSPermanent_updateHostDNS_emptyUpstream(t *testing.T) {
 }
 
 func TestDNSPermanent_updateUpstream(t *testing.T) {
-	skipUnlessAndroid(t)
 	wgIFace, err := createWgInterfaceWithBind(t)
 	if err != nil {
 		t.Fatal("failed to initialize wg interface")
@@ -780,7 +841,6 @@ func TestDNSPermanent_updateUpstream(t *testing.T) {
 }
 
 func TestDNSPermanent_matchOnly(t *testing.T) {
-	skipUnlessAndroid(t)
 	wgIFace, err := createWgInterfaceWithBind(t)
 	if err != nil {
 		t.Fatal("failed to initialize wg interface")
@@ -853,18 +913,6 @@ func TestDNSPermanent_matchOnly(t *testing.T) {
 	}
 }
 
-// skipUnlessAndroid marks tests that exercise the mobile-permanent DNS path,
-// which only matches a real production setup on android (NewDefaultServerPermanentUpstream
-// + androidHostManager). On non-android the desktop host manager replaces it
-// during Initialize and the assertion stops making sense. Skipped here until we
-// have an android CI runner.
-func skipUnlessAndroid(t *testing.T) {
-	t.Helper()
-	if runtime.GOOS != "android" {
-		t.Skip("requires android runner; mobile-permanent path doesn't match production on this OS")
-	}
-}
-
 func createWgInterfaceWithBind(t *testing.T) (*iface.WGIface, error) {
 	t.Helper()
 	ov := os.Getenv("NB_WG_KERNEL_DISABLED")
@@ -1017,6 +1065,7 @@ type mockHandler struct {
 
 func (m *mockHandler) ServeDNS(dns.ResponseWriter, *dns.Msg) {}
 func (m *mockHandler) Stop()                                 {}
+func (m *mockHandler) ProbeAvailability(context.Context)     {}
 func (m *mockHandler) ID() types.HandlerID                   { return types.HandlerID(m.Id) }
 
 type mockService struct{}
@@ -2036,598 +2085,6 @@ func TestLocalResolverPriorityConstants(t *testing.T) {
 	assert.Equal(t, "local.example.com", localMuxUpdates[0].domain)
 }
 
-// TestBuildUpstreamHandler_MergesGroupsPerDomain verifies that multiple
-// admin-defined nameserver groups targeting the same domain collapse into a
-// single handler with each group preserved as a sequential inner list.
-func TestBuildUpstreamHandler_MergesGroupsPerDomain(t *testing.T) {
-	wgInterface := &mocWGIface{}
-	service := NewServiceViaMemory(wgInterface)
-	server := &DefaultServer{
-		ctx:           context.Background(),
-		wgInterface:   wgInterface,
-		service:       service,
-		localResolver: local.NewResolver(),
-		handlerChain:  NewHandlerChain(),
-		hostManager:   &noopHostConfigurator{},
-		dnsMuxMap:     make(registeredHandlerMap),
-	}
-
-	groups := []*nbdns.NameServerGroup{
-		{
-			NameServers: []nbdns.NameServer{
-				{IP: netip.MustParseAddr("192.0.2.1"), NSType: nbdns.UDPNameServerType, Port: 53},
-			},
-			Domains: []string{"example.com"},
-		},
-		{
-			NameServers: []nbdns.NameServer{
-				{IP: netip.MustParseAddr("192.0.2.2"), NSType: nbdns.UDPNameServerType, Port: 53},
-				{IP: netip.MustParseAddr("192.0.2.3"), NSType: nbdns.UDPNameServerType, Port: 53},
-			},
-			Domains: []string{"example.com"},
-		},
-	}
-
-	muxUpdates, err := server.buildUpstreamHandlerUpdate(groups)
-	require.NoError(t, err)
-	require.Len(t, muxUpdates, 1, "same-domain groups should merge into one handler")
-	assert.Equal(t, "example.com", muxUpdates[0].domain)
-	assert.Equal(t, PriorityUpstream, muxUpdates[0].priority)
-
-	handler := muxUpdates[0].handler.(*upstreamResolver)
-	require.Len(t, handler.upstreamServers, 2, "handler should have two groups")
-	assert.Equal(t, upstreamRace{netip.MustParseAddrPort("192.0.2.1:53")}, handler.upstreamServers[0])
-	assert.Equal(t, upstreamRace{
-		netip.MustParseAddrPort("192.0.2.2:53"),
-		netip.MustParseAddrPort("192.0.2.3:53"),
-	}, handler.upstreamServers[1])
-}
-
-// TestEvaluateNSGroupHealth covers the records-only verdict. The gate
-// (overlay route selected-but-no-active-peer) is intentionally NOT an
-// input to the evaluator anymore: the verdict drives the Enabled flag,
-// which must always reflect what we actually observed. Gate-aware event
-// suppression is tested separately in the projection test.
-//
-// Matrix per upstream: {no record, fresh Ok, fresh Fail, stale Fail,
-// stale Ok, Ok newer than Fail, Fail newer than Ok}.
-// Group verdict: any fresh-working → Healthy; any fresh-broken with no
-// fresh-working → Unhealthy; otherwise Undecided.
-func TestEvaluateNSGroupHealth(t *testing.T) {
-	now := time.Now()
-	a := netip.MustParseAddrPort("192.0.2.1:53")
-	b := netip.MustParseAddrPort("192.0.2.2:53")
-
-	recentOk := UpstreamHealth{LastOk: now.Add(-2 * time.Second)}
-	recentFail := UpstreamHealth{LastFail: now.Add(-1 * time.Second), LastErr: "timeout"}
-	staleOk := UpstreamHealth{LastOk: now.Add(-10 * time.Minute)}
-	staleFail := UpstreamHealth{LastFail: now.Add(-10 * time.Minute), LastErr: "timeout"}
-	okThenFail := UpstreamHealth{
-		LastOk:   now.Add(-10 * time.Second),
-		LastFail: now.Add(-1 * time.Second),
-		LastErr:  "timeout",
-	}
-	failThenOk := UpstreamHealth{
-		LastOk:   now.Add(-1 * time.Second),
-		LastFail: now.Add(-10 * time.Second),
-		LastErr:  "timeout",
-	}
-
-	tests := []struct {
-		name         string
-		health       map[netip.AddrPort]UpstreamHealth
-		servers      []netip.AddrPort
-		wantVerdict  nsGroupVerdict
-		wantErrSubst string
-	}{
-		{
-			name:        "no record, undecided",
-			servers:     []netip.AddrPort{a},
-			wantVerdict: nsVerdictUndecided,
-		},
-		{
-			name:        "fresh success, healthy",
-			health:      map[netip.AddrPort]UpstreamHealth{a: recentOk},
-			servers:     []netip.AddrPort{a},
-			wantVerdict: nsVerdictHealthy,
-		},
-		{
-			name:         "fresh failure, unhealthy",
-			health:       map[netip.AddrPort]UpstreamHealth{a: recentFail},
-			servers:      []netip.AddrPort{a},
-			wantVerdict:  nsVerdictUnhealthy,
-			wantErrSubst: "timeout",
-		},
-		{
-			name:        "only stale success, undecided",
-			health:      map[netip.AddrPort]UpstreamHealth{a: staleOk},
-			servers:     []netip.AddrPort{a},
-			wantVerdict: nsVerdictUndecided,
-		},
-		{
-			name:        "only stale failure, undecided",
-			health:      map[netip.AddrPort]UpstreamHealth{a: staleFail},
-			servers:     []netip.AddrPort{a},
-			wantVerdict: nsVerdictUndecided,
-		},
-		{
-			name:         "both fresh, fail newer, unhealthy",
-			health:       map[netip.AddrPort]UpstreamHealth{a: okThenFail},
-			servers:      []netip.AddrPort{a},
-			wantVerdict:  nsVerdictUnhealthy,
-			wantErrSubst: "timeout",
-		},
-		{
-			name:        "both fresh, ok newer, healthy",
-			health:      map[netip.AddrPort]UpstreamHealth{a: failThenOk},
-			servers:     []netip.AddrPort{a},
-			wantVerdict: nsVerdictHealthy,
-		},
-		{
-			name: "two upstreams, one success wins",
-			health: map[netip.AddrPort]UpstreamHealth{
-				a: recentFail,
-				b: recentOk,
-			},
-			servers:     []netip.AddrPort{a, b},
-			wantVerdict: nsVerdictHealthy,
-		},
-		{
-			name: "two upstreams, one fail one unseen, unhealthy",
-			health: map[netip.AddrPort]UpstreamHealth{
-				a: recentFail,
-			},
-			servers:      []netip.AddrPort{a, b},
-			wantVerdict:  nsVerdictUnhealthy,
-			wantErrSubst: "timeout",
-		},
-		{
-			name: "two upstreams, all recent failures, unhealthy",
-			health: map[netip.AddrPort]UpstreamHealth{
-				a: {LastFail: now.Add(-5 * time.Second), LastErr: "timeout"},
-				b: {LastFail: now.Add(-1 * time.Second), LastErr: "SERVFAIL"},
-			},
-			servers:      []netip.AddrPort{a, b},
-			wantVerdict:  nsVerdictUnhealthy,
-			wantErrSubst: "SERVFAIL",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			verdict, err := evaluateNSGroupHealth(tc.health, tc.servers, now)
-			assert.Equal(t, tc.wantVerdict, verdict, "verdict mismatch")
-			if tc.wantErrSubst != "" {
-				require.Error(t, err)
-				assert.Contains(t, err.Error(), tc.wantErrSubst)
-			} else {
-				assert.NoError(t, err)
-			}
-		})
-	}
-}
-
-// healthStubHandler is a minimal dnsMuxMap entry that exposes a fixed
-// UpstreamHealth snapshot, letting tests drive recomputeNSGroupStates
-// without spinning up real handlers.
-type healthStubHandler struct {
-	health map[netip.AddrPort]UpstreamHealth
-}
-
-func (h *healthStubHandler) ServeDNS(dns.ResponseWriter, *dns.Msg) {}
-func (h *healthStubHandler) Stop()                                 {}
-func (h *healthStubHandler) ID() types.HandlerID                   { return "health-stub" }
-func (h *healthStubHandler) UpstreamHealth() map[netip.AddrPort]UpstreamHealth {
-	return h.health
-}
-
-// TestProjection_SteadyStateIsSilent guards against duplicate events:
-// while a group stays Unhealthy tick after tick, only the first
-// Unhealthy transition may emit. Same for staying Healthy.
-func TestProjection_SteadyStateIsSilent(t *testing.T) {
-	fx := newProjTestFixture(t)
-
-	fx.setHealth(UpstreamHealth{LastFail: time.Now(), LastErr: "timeout"})
-	fx.tick()
-	fx.expectEvent("unreachable", "first fail emits warning")
-
-	fx.setHealth(UpstreamHealth{LastFail: time.Now(), LastErr: "timeout"})
-	fx.tick()
-	fx.tick()
-	fx.expectNoEvent("staying unhealthy must not re-emit")
-
-	fx.setHealth(UpstreamHealth{LastOk: time.Now()})
-	fx.tick()
-	fx.expectEvent("recovered", "recovery on transition")
-
-	fx.tick()
-	fx.tick()
-	fx.expectNoEvent("staying healthy must not re-emit")
-}
-
-// projTestFixture is the common setup for the projection tests: a
-// single-upstream group whose route classification the test can flip by
-// assigning to selected/active. Callers drive failures/successes by
-// mutating stub.health and calling refreshHealth.
-type projTestFixture struct {
-	t        *testing.T
-	recorder *peer.Status
-	events   <-chan *proto.SystemEvent
-	server   *DefaultServer
-	stub     *healthStubHandler
-	group    *nbdns.NameServerGroup
-	srv      netip.AddrPort
-	selected route.HAMap
-	active   route.HAMap
-}
-
-func newProjTestFixture(t *testing.T) *projTestFixture {
-	t.Helper()
-	recorder := peer.NewRecorder("mgm")
-	sub := recorder.SubscribeToEvents()
-	t.Cleanup(func() { recorder.UnsubscribeFromEvents(sub) })
-
-	srv := netip.MustParseAddrPort("100.64.0.1:53")
-	fx := &projTestFixture{
-		t:        t,
-		recorder: recorder,
-		events:   sub.Events(),
-		stub:     &healthStubHandler{health: map[netip.AddrPort]UpstreamHealth{}},
-		srv:      srv,
-		group: &nbdns.NameServerGroup{
-			Domains:     []string{"example.com"},
-			NameServers: []nbdns.NameServer{{IP: srv.Addr(), NSType: nbdns.UDPNameServerType, Port: int(srv.Port())}},
-		},
-	}
-	fx.server = &DefaultServer{
-		ctx:              context.Background(),
-		wgInterface:      &mocWGIface{},
-		statusRecorder:   recorder,
-		dnsMuxMap:        make(registeredHandlerMap),
-		selectedRoutes:   func() route.HAMap { return fx.selected },
-		activeRoutes:     func() route.HAMap { return fx.active },
-		warningDelayBase: defaultWarningDelayBase,
-	}
-	fx.server.dnsMuxMap["example.com"] = handlerWrapper{domain: "example.com", handler: fx.stub, priority: PriorityUpstream}
-
-	fx.server.mux.Lock()
-	fx.server.updateNSGroupStates([]*nbdns.NameServerGroup{fx.group})
-	fx.server.mux.Unlock()
-	return fx
-}
-
-func (f *projTestFixture) setHealth(h UpstreamHealth) {
-	f.stub.health = map[netip.AddrPort]UpstreamHealth{f.srv: h}
-}
-
-func (f *projTestFixture) tick() []peer.NSGroupState {
-	f.server.refreshHealth()
-	return f.recorder.GetDNSStates()
-}
-
-func (f *projTestFixture) expectNoEvent(why string) {
-	f.t.Helper()
-	select {
-	case evt := <-f.events:
-		f.t.Fatalf("unexpected event (%s): %+v", why, evt)
-	case <-time.After(100 * time.Millisecond):
-	}
-}
-
-func (f *projTestFixture) expectEvent(substr, why string) *proto.SystemEvent {
-	f.t.Helper()
-	select {
-	case evt := <-f.events:
-		assert.Contains(f.t, evt.Message, substr, why)
-		return evt
-	case <-time.After(time.Second):
-		f.t.Fatalf("expected event (%s) with %q", why, substr)
-		return nil
-	}
-}
-
-var overlayNetForTest = netip.MustParsePrefix("100.64.0.0/16")
-var overlayMapForTest = route.HAMap{"overlay": {{Network: overlayNetForTest}}}
-
-// TestProjection_PublicFailEmitsImmediately covers rule 1: an upstream
-// that is not inside any selected route (public DNS) fires the warning
-// on the first Unhealthy tick, no grace period.
-func TestProjection_PublicFailEmitsImmediately(t *testing.T) {
-	fx := newProjTestFixture(t)
-
-	fx.setHealth(UpstreamHealth{LastFail: time.Now(), LastErr: "timeout"})
-	states := fx.tick()
-	require.Len(t, states, 1)
-	assert.False(t, states[0].Enabled)
-	fx.expectEvent("unreachable", "public DNS failure")
-}
-
-// TestProjection_OverlayConnectedFailEmitsImmediately covers rule 2:
-// the upstream is inside a selected route AND the route has a Connected
-// peer. Tunnel is up, failure is real, emit immediately.
-func TestProjection_OverlayConnectedFailEmitsImmediately(t *testing.T) {
-	fx := newProjTestFixture(t)
-	fx.selected = overlayMapForTest
-	fx.active = overlayMapForTest
-
-	fx.setHealth(UpstreamHealth{LastFail: time.Now(), LastErr: "timeout"})
-	states := fx.tick()
-	require.Len(t, states, 1)
-	assert.False(t, states[0].Enabled)
-	fx.expectEvent("unreachable", "overlay + connected failure")
-}
-
-// TestProjection_OverlayNotConnectedDelaysWarning covers rule 3: the
-// upstream is routed but no peer is Connected (Connecting/Idle/missing).
-// First tick: Unhealthy display, no warning. After the grace window
-// elapses with no recovery, the warning fires.
-func TestProjection_OverlayNotConnectedDelaysWarning(t *testing.T) {
-	grace := 50 * time.Millisecond
-	fx := newProjTestFixture(t)
-	fx.server.warningDelayBase = grace
-	fx.selected = overlayMapForTest
-	// active stays nil: routed but not connected.
-
-	fx.setHealth(UpstreamHealth{LastFail: time.Now(), LastErr: "timeout"})
-	states := fx.tick()
-	require.Len(t, states, 1)
-	assert.False(t, states[0].Enabled, "display must reflect failure even during grace window")
-	fx.expectNoEvent("first fail tick within grace window")
-
-	time.Sleep(grace + 10*time.Millisecond)
-	fx.setHealth(UpstreamHealth{LastFail: time.Now(), LastErr: "timeout"})
-	fx.tick()
-	fx.expectEvent("unreachable", "warning after grace window")
-}
-
-// TestProjection_OverlayAddrNoRouteDelaysWarning covers an upstream
-// whose address is inside the WireGuard overlay range but is not
-// covered by any selected route (peer-to-peer DNS without an explicit
-// route). Until a peer reports Connected for that address, startup
-// failures must be held just like the routed case.
-func TestProjection_OverlayAddrNoRouteDelaysWarning(t *testing.T) {
-	recorder := peer.NewRecorder("mgm")
-	sub := recorder.SubscribeToEvents()
-	t.Cleanup(func() { recorder.UnsubscribeFromEvents(sub) })
-
-	overlayPeer := netip.MustParseAddrPort("100.66.100.5:53")
-	server := &DefaultServer{
-		ctx:              context.Background(),
-		wgInterface:      &mocWGIface{},
-		statusRecorder:   recorder,
-		dnsMuxMap:        make(registeredHandlerMap),
-		selectedRoutes:   func() route.HAMap { return nil },
-		activeRoutes:     func() route.HAMap { return nil },
-		warningDelayBase: 50 * time.Millisecond,
-	}
-	group := &nbdns.NameServerGroup{
-		Domains:     []string{"example.com"},
-		NameServers: []nbdns.NameServer{{IP: overlayPeer.Addr(), NSType: nbdns.UDPNameServerType, Port: int(overlayPeer.Port())}},
-	}
-	stub := &healthStubHandler{health: map[netip.AddrPort]UpstreamHealth{
-		overlayPeer: {LastFail: time.Now(), LastErr: "timeout"},
-	}}
-	server.dnsMuxMap["example.com"] = handlerWrapper{domain: "example.com", handler: stub, priority: PriorityUpstream}
-
-	server.mux.Lock()
-	server.updateNSGroupStates([]*nbdns.NameServerGroup{group})
-	server.mux.Unlock()
-	server.refreshHealth()
-
-	select {
-	case evt := <-sub.Events():
-		t.Fatalf("unexpected event during grace window: %+v", evt)
-	case <-time.After(100 * time.Millisecond):
-	}
-
-	time.Sleep(60 * time.Millisecond)
-	stub.health = map[netip.AddrPort]UpstreamHealth{overlayPeer: {LastFail: time.Now(), LastErr: "timeout"}}
-	server.refreshHealth()
-
-	select {
-	case evt := <-sub.Events():
-		assert.Contains(t, evt.Message, "unreachable")
-	case <-time.After(time.Second):
-		t.Fatal("expected warning after grace window")
-	}
-}
-
-// TestProjection_StopClearsHealthState verifies that Stop wipes the
-// per-group projection state so a subsequent Start doesn't inherit
-// sticky flags (notably everHealthy) that would bypass the grace
-// window during the next peer handshake.
-func TestProjection_StopClearsHealthState(t *testing.T) {
-	wgIface := &mocWGIface{}
-	server := &DefaultServer{
-		ctx:               context.Background(),
-		wgInterface:       wgIface,
-		service:           NewServiceViaMemory(wgIface),
-		hostManager:       &noopHostConfigurator{},
-		extraDomains:      map[domain.Domain]int{},
-		dnsMuxMap:         make(registeredHandlerMap),
-		statusRecorder:    peer.NewRecorder("mgm"),
-		selectedRoutes:    func() route.HAMap { return nil },
-		activeRoutes:      func() route.HAMap { return nil },
-		warningDelayBase:  defaultWarningDelayBase,
-		currentConfigHash: ^uint64(0),
-	}
-	server.ctx, server.ctxCancel = context.WithCancel(context.Background())
-
-	srv := netip.MustParseAddrPort("8.8.8.8:53")
-	group := &nbdns.NameServerGroup{
-		Domains:     []string{"example.com"},
-		NameServers: []nbdns.NameServer{{IP: srv.Addr(), NSType: nbdns.UDPNameServerType, Port: int(srv.Port())}},
-	}
-	stub := &healthStubHandler{health: map[netip.AddrPort]UpstreamHealth{srv: {LastOk: time.Now()}}}
-	server.dnsMuxMap["example.com"] = handlerWrapper{domain: "example.com", handler: stub, priority: PriorityUpstream}
-
-	server.mux.Lock()
-	server.updateNSGroupStates([]*nbdns.NameServerGroup{group})
-	server.mux.Unlock()
-	server.refreshHealth()
-
-	server.healthProjectMu.Lock()
-	p, ok := server.nsGroupProj[generateGroupKey(group)]
-	server.healthProjectMu.Unlock()
-	require.True(t, ok, "projection state should exist after tick")
-	require.True(t, p.everHealthy, "tick with success must set everHealthy")
-
-	server.Stop()
-
-	server.healthProjectMu.Lock()
-	cleared := server.nsGroupProj == nil
-	server.healthProjectMu.Unlock()
-	assert.True(t, cleared, "Stop must clear nsGroupProj")
-}
-
-// TestProjection_OverlayRecoversDuringGrace covers the happy path of
-// rule 3: startup failures while the peer is handshaking, then the peer
-// comes up and a query succeeds before the grace window elapses. No
-// warning should ever have fired, and no recovery either.
-func TestProjection_OverlayRecoversDuringGrace(t *testing.T) {
-	fx := newProjTestFixture(t)
-	fx.server.warningDelayBase = 200 * time.Millisecond
-	fx.selected = overlayMapForTest
-
-	fx.setHealth(UpstreamHealth{LastFail: time.Now(), LastErr: "timeout"})
-	fx.tick()
-	fx.expectNoEvent("fail within grace, warning suppressed")
-
-	fx.active = overlayMapForTest
-	fx.setHealth(UpstreamHealth{LastOk: time.Now()})
-	states := fx.tick()
-	require.Len(t, states, 1)
-	assert.True(t, states[0].Enabled)
-	fx.expectNoEvent("recovery without prior warning must not emit")
-}
-
-// TestProjection_RecoveryOnlyAfterWarning enforces the invariant the
-// whole design leans on: recovery events only appear when a warning
-// event was actually emitted for the current streak. A Healthy verdict
-// without a prior warning is silent, so the user never sees "recovered"
-// out of thin air.
-func TestProjection_RecoveryOnlyAfterWarning(t *testing.T) {
-	fx := newProjTestFixture(t)
-
-	fx.setHealth(UpstreamHealth{LastOk: time.Now()})
-	states := fx.tick()
-	require.Len(t, states, 1)
-	assert.True(t, states[0].Enabled)
-	fx.expectNoEvent("first healthy tick should not recover anything")
-
-	fx.setHealth(UpstreamHealth{LastFail: time.Now(), LastErr: "timeout"})
-	fx.tick()
-	fx.expectEvent("unreachable", "public fail emits immediately")
-
-	fx.setHealth(UpstreamHealth{LastOk: time.Now()})
-	fx.tick()
-	fx.expectEvent("recovered", "recovery follows real warning")
-
-	fx.setHealth(UpstreamHealth{LastFail: time.Now(), LastErr: "timeout"})
-	fx.tick()
-	fx.expectEvent("unreachable", "second cycle warning")
-
-	fx.setHealth(UpstreamHealth{LastOk: time.Now()})
-	fx.tick()
-	fx.expectEvent("recovered", "second cycle recovery")
-}
-
-// TestProjection_EverHealthyOverridesDelay covers rule 4: once a group
-// has ever been Healthy, subsequent failures skip the grace window even
-// if classification says "routed + not connected". The system has
-// proved it can work, so any new failure is real.
-func TestProjection_EverHealthyOverridesDelay(t *testing.T) {
-	fx := newProjTestFixture(t)
-	// Large base so any emission must come from the everHealthy bypass, not elapsed time.
-	fx.server.warningDelayBase = time.Hour
-	fx.selected = overlayMapForTest
-	fx.active = overlayMapForTest
-
-	// Establish "ever healthy".
-	fx.setHealth(UpstreamHealth{LastOk: time.Now()})
-	fx.tick()
-	fx.expectNoEvent("first healthy tick")
-
-	// Peer drops. Query fails. Routed + not connected → normally grace,
-	// but everHealthy flag bypasses it.
-	fx.active = nil
-	fx.setHealth(UpstreamHealth{LastFail: time.Now(), LastErr: "timeout"})
-	fx.tick()
-	fx.expectEvent("unreachable", "failure after ever-healthy must be immediate")
-}
-
-// TestProjection_ReconnectBlipEmitsPair covers the explicit tradeoff
-// from the design discussion: once a group has been healthy, a brief
-// reconnect that produces a failing tick will fire warning + recovery.
-// This is by design: user-visible blips are accurate signal, not noise.
-func TestProjection_ReconnectBlipEmitsPair(t *testing.T) {
-	fx := newProjTestFixture(t)
-	fx.selected = overlayMapForTest
-	fx.active = overlayMapForTest
-
-	fx.setHealth(UpstreamHealth{LastOk: time.Now()})
-	fx.tick()
-
-	fx.setHealth(UpstreamHealth{LastFail: time.Now(), LastErr: "timeout"})
-	fx.tick()
-	fx.expectEvent("unreachable", "blip warning")
-
-	fx.setHealth(UpstreamHealth{LastOk: time.Now()})
-	fx.tick()
-	fx.expectEvent("recovered", "blip recovery")
-}
-
-// TestProjection_MixedGroupEmitsImmediately covers the multi-upstream
-// rule: a group with at least one public upstream is in the "immediate"
-// category regardless of the other upstreams' routing, because the
-// public one has no peer-startup excuse. Prevents public-DNS failures
-// from being hidden behind a routed sibling.
-func TestProjection_MixedGroupEmitsImmediately(t *testing.T) {
-	recorder := peer.NewRecorder("mgm")
-	sub := recorder.SubscribeToEvents()
-	t.Cleanup(func() { recorder.UnsubscribeFromEvents(sub) })
-	events := sub.Events()
-
-	public := netip.MustParseAddrPort("8.8.8.8:53")
-	overlay := netip.MustParseAddrPort("100.64.0.1:53")
-	overlayMap := route.HAMap{"overlay": {{Network: netip.MustParsePrefix("100.64.0.0/16")}}}
-
-	server := &DefaultServer{
-		ctx:              context.Background(),
-		statusRecorder:   recorder,
-		dnsMuxMap:        make(registeredHandlerMap),
-		selectedRoutes:   func() route.HAMap { return overlayMap },
-		activeRoutes:     func() route.HAMap { return nil },
-		warningDelayBase: time.Hour,
-	}
-	group := &nbdns.NameServerGroup{
-		Domains: []string{"example.com"},
-		NameServers: []nbdns.NameServer{
-			{IP: public.Addr(), NSType: nbdns.UDPNameServerType, Port: int(public.Port())},
-			{IP: overlay.Addr(), NSType: nbdns.UDPNameServerType, Port: int(overlay.Port())},
-		},
-	}
-	stub := &healthStubHandler{
-		health: map[netip.AddrPort]UpstreamHealth{
-			public:  {LastFail: time.Now(), LastErr: "servfail"},
-			overlay: {LastFail: time.Now(), LastErr: "timeout"},
-		},
-	}
-	server.dnsMuxMap["example.com"] = handlerWrapper{domain: "example.com", handler: stub, priority: PriorityUpstream}
-
-	server.mux.Lock()
-	server.updateNSGroupStates([]*nbdns.NameServerGroup{group})
-	server.mux.Unlock()
-	server.refreshHealth()
-
-	select {
-	case evt := <-events:
-		assert.Contains(t, evt.Message, "unreachable")
-	case <-time.After(time.Second):
-		t.Fatal("expected immediate warning because group contains a public upstream")
-	}
-}
-
 func TestDNSLoopPrevention(t *testing.T) {
 	wgInterface := &mocWGIface{}
 	service := NewServiceViaMemory(wgInterface)
@@ -2726,18 +2183,17 @@ func TestDNSLoopPrevention(t *testing.T) {
 
 			if tt.expectedHandlers > 0 {
 				handler := muxUpdates[0].handler.(*upstreamResolver)
-				flat := handler.flatUpstreams()
-				assert.Len(t, flat, len(tt.expectedServers))
+				assert.Len(t, handler.upstreamServers, len(tt.expectedServers))
 
 				if tt.shouldFilterOwnIP {
-					for _, upstream := range flat {
+					for _, upstream := range handler.upstreamServers {
 						assert.NotEqual(t, dnsServerIP, upstream.Addr())
 					}
 				}
 
 				for _, expected := range tt.expectedServers {
 					found := false
-					for _, upstream := range flat {
+					for _, upstream := range handler.upstreamServers {
 						if upstream.Addr() == expected {
 							found = true
 							break

client/internal/dns/systemd_linux.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
-	"slices"
 	"time"
 
 	"github.com/godbus/dbus/v5"
@@ -41,17 +40,10 @@ const (
 )
 
 type systemdDbusConfigurator struct {
-	dbusLinkObject  dbus.ObjectPath
-	ifaceName       string
-	wgIndex         int
-	origNameservers []netip.Addr
+	dbusLinkObject dbus.ObjectPath
+	ifaceName      string
 }
 
-const (
-	systemdDbusLinkDNSProperty          = systemdDbusLinkInterface + ".DNS"
-	systemdDbusLinkDefaultRouteProperty = systemdDbusLinkInterface + ".DefaultRoute"
-)
-
 // the types below are based on dbus specification, each field is mapped to a dbus type
 // see https://dbus.freedesktop.org/doc/dbus-specification.html#basic-types for more details on dbus types
 // see https://www.freedesktop.org/software/systemd/man/org.freedesktop.resolve1.html on resolve1 input types
@@ -87,145 +79,10 @@ func newSystemdDbusConfigurator(wgInterface string) (*systemdDbusConfigurator, e
 
 	log.Debugf("got dbus Link interface: %s from net interface %s and index %d", s, iface.Name, iface.Index)
 
-	c := &systemdDbusConfigurator{
+	return &systemdDbusConfigurator{
 		dbusLinkObject: dbus.ObjectPath(s),
 		ifaceName:      wgInterface,
-		wgIndex:        iface.Index,
-	}
-
-	origNameservers, err := c.captureOriginalNameservers()
-	switch {
-	case err != nil:
-		log.Warnf("capture original nameservers from systemd-resolved: %v", err)
-	case len(origNameservers) == 0:
-		log.Warnf("no original nameservers captured from systemd-resolved default-route links; DNS fallback will be empty")
-	default:
-		log.Debugf("captured %d original nameservers from systemd-resolved default-route links: %v", len(origNameservers), origNameservers)
-	}
-	c.origNameservers = origNameservers
-	return c, nil
-}
-
-// captureOriginalNameservers reads per-link DNS from systemd-resolved for
-// every default-route link except our own WG link. Non-default-route links
-// (VPNs, docker bridges) are skipped because their upstreams wouldn't
-// actually serve host queries.
-func (s *systemdDbusConfigurator) captureOriginalNameservers() ([]netip.Addr, error) {
-	ifaces, err := net.Interfaces()
-	if err != nil {
-		return nil, fmt.Errorf("list interfaces: %w", err)
-	}
-
-	seen := make(map[netip.Addr]struct{})
-	var out []netip.Addr
-	for _, iface := range ifaces {
-		if !s.isCandidateLink(iface) {
-			continue
-		}
-		linkPath, err := getSystemdLinkPath(iface.Index)
-		if err != nil || !isSystemdLinkDefaultRoute(linkPath) {
-			continue
-		}
-		for _, addr := range readSystemdLinkDNS(linkPath) {
-			addr = normalizeSystemdAddr(addr, iface.Name)
-			if !addr.IsValid() {
-				continue
-			}
-			if _, dup := seen[addr]; dup {
-				continue
-			}
-			seen[addr] = struct{}{}
-			out = append(out, addr)
-		}
-	}
-	return out, nil
-}
-
-func (s *systemdDbusConfigurator) isCandidateLink(iface net.Interface) bool {
-	if iface.Index == s.wgIndex {
-		return false
-	}
-	if iface.Flags&net.FlagLoopback != 0 || iface.Flags&net.FlagUp == 0 {
-		return false
-	}
-	return true
-}
-
-// normalizeSystemdAddr unmaps v4-mapped-v6, drops unspecified, and reattaches
-// the link's iface name as zone for link-local v6 (Link.DNS strips it).
-// Returns the zero Addr to signal "skip this entry".
-func normalizeSystemdAddr(addr netip.Addr, ifaceName string) netip.Addr {
-	addr = addr.Unmap()
-	if !addr.IsValid() || addr.IsUnspecified() {
-		return netip.Addr{}
-	}
-	if addr.IsLinkLocalUnicast() {
-		return addr.WithZone(ifaceName)
-	}
-	return addr
-}
-
-func getSystemdLinkPath(ifIndex int) (dbus.ObjectPath, error) {
-	obj, closeConn, err := getDbusObject(systemdResolvedDest, systemdDbusObjectNode)
-	if err != nil {
-		return "", fmt.Errorf("dbus resolve1: %w", err)
-	}
-	defer closeConn()
-	var p string
-	if err := obj.Call(systemdDbusGetLinkMethod, dbusDefaultFlag, int32(ifIndex)).Store(&p); err != nil {
-		return "", err
-	}
-	return dbus.ObjectPath(p), nil
-}
-
-func isSystemdLinkDefaultRoute(linkPath dbus.ObjectPath) bool {
-	obj, closeConn, err := getDbusObject(systemdResolvedDest, linkPath)
-	if err != nil {
-		return false
-	}
-	defer closeConn()
-	v, err := obj.GetProperty(systemdDbusLinkDefaultRouteProperty)
-	if err != nil {
-		return false
-	}
-	b, ok := v.Value().(bool)
-	return ok && b
-}
-
-func readSystemdLinkDNS(linkPath dbus.ObjectPath) []netip.Addr {
-	obj, closeConn, err := getDbusObject(systemdResolvedDest, linkPath)
-	if err != nil {
-		return nil
-	}
-	defer closeConn()
-	v, err := obj.GetProperty(systemdDbusLinkDNSProperty)
-	if err != nil {
-		return nil
-	}
-	entries, ok := v.Value().([][]any)
-	if !ok {
-		return nil
-	}
-	var out []netip.Addr
-	for _, entry := range entries {
-		if len(entry) < 2 {
-			continue
-		}
-		raw, ok := entry[1].([]byte)
-		if !ok {
-			continue
-		}
-		addr, ok := netip.AddrFromSlice(raw)
-		if !ok {
-			continue
-		}
-		out = append(out, addr)
-	}
-	return out
-}
-
-func (s *systemdDbusConfigurator) getOriginalNameservers() []netip.Addr {
-	return slices.Clone(s.origNameservers)
+	}, nil
 }
 
 func (s *systemdDbusConfigurator) supportCustomPort() bool {

client/internal/dns/upstream.go

@@ -1,32 +1,3 @@
-// Package dns implements the client-side DNS stack: listener/service on the
-// peer's tunnel address, handler chain that routes questions by domain and
-// priority, and upstream resolvers that forward what remains to configured
-// nameservers.
-//
-// # Upstream resolution and the race model
-//
-// When two or more nameserver groups target the same domain, DefaultServer
-// merges them into one upstream handler whose state is:
-//
-//	upstreamResolverBase
-//	  └── upstreamServers []upstreamRace   // one entry per source NS group
-//	        └── []netip.AddrPort           // primary, fallback, ...
-//
-// Each source nameserver group contributes one upstreamRace. Within a race
-// upstreams are tried in order: the next is used only on failure (timeout,
-// SERVFAIL, REFUSED, no response). NXDOMAIN is a valid answer and stops
-// the walk. When more than one race exists, ServeDNS fans out one
-// goroutine per race and returns the first valid answer, cancelling the
-// rest. A handler with a single race skips the fan-out.
-//
-// # Health projection
-//
-// Query outcomes are recorded per-upstream in UpstreamHealth. The server
-// periodically merges these snapshots across handlers and projects them
-// into peer.NSGroupState. There is no active probing: a group is marked
-// unhealthy only when every seen upstream has a recent failure and none
-// has a recent success. Healthy→unhealthy fires a single
-// SystemEvent_WARNING; steady-state refreshes do not duplicate it.
 package dns
 
 import (
@@ -40,8 +11,11 @@ import (
 	"slices"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
+	"github.com/cenkalti/backoff/v4"
+	"github.com/hashicorp/go-multierror"
 	"github.com/miekg/dns"
 	log "github.com/sirupsen/logrus"
 	"golang.zx2c4.com/wireguard/tun/netstack"
@@ -50,12 +24,32 @@ import (
 	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/dns/types"
 	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/route"
-	"github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/client/proto"
 )
 
 var currentMTU uint16 = iface.DefaultMTU
 
+// nonRetryableEDECodes lists EDE info codes (RFC 8914) for which a SERVFAIL
+// from one upstream means another upstream would return the same answer:
+// DNSSEC validation outcomes and policy-based blocks. Transient errors
+// (network, cached, not ready) are not included.
+var nonRetryableEDECodes = map[uint16]struct{}{
+	dns.ExtendedErrorCodeUnsupportedDNSKEYAlgorithm: {},
+	dns.ExtendedErrorCodeUnsupportedDSDigestType:    {},
+	dns.ExtendedErrorCodeDNSSECIndeterminate:        {},
+	dns.ExtendedErrorCodeDNSBogus:                   {},
+	dns.ExtendedErrorCodeSignatureExpired:           {},
+	dns.ExtendedErrorCodeSignatureNotYetValid:       {},
+	dns.ExtendedErrorCodeDNSKEYMissing:              {},
+	dns.ExtendedErrorCodeRRSIGsMissing:              {},
+	dns.ExtendedErrorCodeNoZoneKeyBitSet:            {},
+	dns.ExtendedErrorCodeNSECMissing:                {},
+	dns.ExtendedErrorCodeBlocked:                    {},
+	dns.ExtendedErrorCodeCensored:                   {},
+	dns.ExtendedErrorCodeFiltered:                   {},
+	dns.ExtendedErrorCodeProhibited:                 {},
+}
+
 func SetCurrentMTU(mtu uint16) {
 	currentMTU = mtu
 }
@@ -66,18 +60,16 @@ const (
 	// Set longer than UpstreamTimeout to ensure context timeout takes precedence
 	ClientTimeout = 5 * time.Second
 
+	reactivatePeriod = 30 * time.Second
+	probeTimeout     = 2 * time.Second
+
 	// ipv6HeaderSize + udpHeaderSize, used to derive the maximum DNS UDP
 	// payload from the tunnel MTU.
 	ipUDPHeaderSize = 60 + 8
-
-	// raceMaxTotalTimeout caps the combined time spent walking all upstreams
-	// within one race, so a slow primary can't eat the whole race budget.
-	raceMaxTotalTimeout = 5 * time.Second
-	// raceMinPerUpstreamTimeout is the floor applied when dividing
-	// raceMaxTotalTimeout across upstreams within a race.
-	raceMinPerUpstreamTimeout = 2 * time.Second
 )
 
+const testRecord = "com."
+
 const (
 	protoUDP = "udp"
 	protoTCP = "tcp"
@@ -85,68 +77,6 @@ const (
 
 type dnsProtocolKey struct{}
 
-type upstreamProtocolKey struct{}
-
-// upstreamProtocolResult holds the protocol used for the upstream exchange.
-// Stored as a pointer in context so the exchange function can set it.
-type upstreamProtocolResult struct {
-	protocol string
-}
-
-type upstreamClient interface {
-	exchange(ctx context.Context, upstream string, r *dns.Msg) (*dns.Msg, time.Duration, error)
-}
-
-type UpstreamResolver interface {
-	serveDNS(r *dns.Msg) (*dns.Msg, time.Duration, error)
-	upstreamExchange(upstream string, r *dns.Msg) (*dns.Msg, time.Duration, error)
-}
-
-// upstreamRace is an ordered list of upstreams derived from one configured
-// nameserver group. Order matters: the first upstream is tried first, the
-// second only on failure, and so on. Multiple upstreamRace values coexist
-// inside one resolver when overlapping nameserver groups target the same
-// domain; those races run in parallel and the first valid answer wins.
-type upstreamRace []netip.AddrPort
-
-// UpstreamHealth is the last query-path outcome for a single upstream,
-// consumed by nameserver-group status projection.
-type UpstreamHealth struct {
-	LastOk   time.Time
-	LastFail time.Time
-	LastErr  string
-}
-
-type upstreamResolverBase struct {
-	ctx             context.Context
-	cancel          context.CancelFunc
-	upstreamClient  upstreamClient
-	upstreamServers []upstreamRace
-	domain          domain.Domain
-	upstreamTimeout time.Duration
-
-	healthMu sync.RWMutex
-	health   map[netip.AddrPort]*UpstreamHealth
-
-	statusRecorder *peer.Status
-	// selectedRoutes returns the current set of client routes the admin
-	// has enabled. Called lazily from the query hot path when an upstream
-	// might need a tunnel-bound client (iOS) and from health projection.
-	selectedRoutes func() route.HAMap
-}
-
-type upstreamFailure struct {
-	upstream netip.AddrPort
-	reason   string
-}
-
-type raceResult struct {
-	msg      *dns.Msg
-	upstream netip.AddrPort
-	protocol string
-	failures []upstreamFailure
-}
-
 // contextWithDNSProtocol stores the inbound DNS protocol ("udp" or "tcp") in context.
 func contextWithDNSProtocol(ctx context.Context, network string) context.Context {
 	return context.WithValue(ctx, dnsProtocolKey{}, network)
@@ -163,8 +93,16 @@ func dnsProtocolFromContext(ctx context.Context) string {
 	return ""
 }
 
-// contextWithUpstreamProtocolResult stores a mutable result holder in the context.
-func contextWithUpstreamProtocolResult(ctx context.Context) (context.Context, *upstreamProtocolResult) {
+type upstreamProtocolKey struct{}
+
+// upstreamProtocolResult holds the protocol used for the upstream exchange.
+// Stored as a pointer in context so the exchange function can set it.
+type upstreamProtocolResult struct {
+	protocol string
+}
+
+// contextWithupstreamProtocolResult stores a mutable result holder in the context.
+func contextWithupstreamProtocolResult(ctx context.Context) (context.Context, *upstreamProtocolResult) {
 	r := &upstreamProtocolResult{}
 	return context.WithValue(ctx, upstreamProtocolKey{}, r), r
 }
@@ -179,37 +117,67 @@ func setUpstreamProtocol(ctx context.Context, protocol string) {
 	}
 }
 
-func newUpstreamResolverBase(ctx context.Context, statusRecorder *peer.Status, d domain.Domain) *upstreamResolverBase {
+type upstreamClient interface {
+	exchange(ctx context.Context, upstream string, r *dns.Msg) (*dns.Msg, time.Duration, error)
+}
+
+type UpstreamResolver interface {
+	serveDNS(r *dns.Msg) (*dns.Msg, time.Duration, error)
+	upstreamExchange(upstream string, r *dns.Msg) (*dns.Msg, time.Duration, error)
+}
+
+type upstreamResolverBase struct {
+	ctx              context.Context
+	cancel           context.CancelFunc
+	upstreamClient   upstreamClient
+	upstreamServers  []netip.AddrPort
+	domain           string
+	disabled         bool
+	successCount     atomic.Int32
+	mutex            sync.Mutex
+	reactivatePeriod time.Duration
+	upstreamTimeout  time.Duration
+	wg               sync.WaitGroup
+
+	deactivate     func(error)
+	reactivate     func()
+	statusRecorder *peer.Status
+	routeMatch     func(netip.Addr) bool
+}
+
+type upstreamFailure struct {
+	upstream netip.AddrPort
+	reason   string
+}
+
+func newUpstreamResolverBase(ctx context.Context, statusRecorder *peer.Status, domain string) *upstreamResolverBase {
 	ctx, cancel := context.WithCancel(ctx)
 
 	return &upstreamResolverBase{
-		ctx:             ctx,
-		cancel:          cancel,
-		domain:          d,
-		upstreamTimeout: UpstreamTimeout,
-		statusRecorder:  statusRecorder,
+		ctx:              ctx,
+		cancel:           cancel,
+		domain:           domain,
+		upstreamTimeout:  UpstreamTimeout,
+		reactivatePeriod: reactivatePeriod,
+		statusRecorder:   statusRecorder,
 	}
 }
 
 // String returns a string representation of the upstream resolver
 func (u *upstreamResolverBase) String() string {
-	return fmt.Sprintf("Upstream %s", u.flatUpstreams())
+	return fmt.Sprintf("Upstream %s", u.upstreamServers)
 }
 
-// ID returns the unique handler ID. Race groupings and within-race
-// ordering are both part of the identity: [[A,B]] and [[A],[B]] query
-// the same servers but with different semantics (serial fallback vs
-// parallel race), so their handlers must not collide.
+// ID returns the unique handler ID
 func (u *upstreamResolverBase) ID() types.HandlerID {
+	servers := slices.Clone(u.upstreamServers)
+	slices.SortFunc(servers, func(a, b netip.AddrPort) int { return a.Compare(b) })
+
 	hash := sha256.New()
-	hash.Write([]byte(u.domain.PunycodeString() + ":"))
-	for _, race := range u.upstreamServers {
-		hash.Write([]byte("["))
-		for _, s := range race {
-			hash.Write([]byte(s.String()))
-			hash.Write([]byte("|"))
-		}
-		hash.Write([]byte("]"))
+	hash.Write([]byte(u.domain + ":"))
+	for _, s := range servers {
+		hash.Write([]byte(s.String()))
+		hash.Write([]byte("|"))
 	}
 	return types.HandlerID("upstream-" + hex.EncodeToString(hash.Sum(nil)[:8]))
 }
@@ -219,31 +187,13 @@ func (u *upstreamResolverBase) MatchSubdomains() bool {
 }
 
 func (u *upstreamResolverBase) Stop() {
-	log.Debugf("stopping serving DNS for upstreams %s", u.flatUpstreams())
+	log.Debugf("stopping serving DNS for upstreams %s", u.upstreamServers)
 	u.cancel()
-}
 
-// flatUpstreams is for logging and ID hashing only, not for dispatch.
-func (u *upstreamResolverBase) flatUpstreams() []netip.AddrPort {
-	var out []netip.AddrPort
-	for _, g := range u.upstreamServers {
-		out = append(out, g...)
-	}
-	return out
-}
+	u.mutex.Lock()
+	u.wg.Wait()
+	u.mutex.Unlock()
 
-// setSelectedRoutes swaps the accessor used to classify overlay-routed
-// upstreams. Called when route sources are wired after the handler was
-// built (permanent / iOS constructors).
-func (u *upstreamResolverBase) setSelectedRoutes(selected func() route.HAMap) {
-	u.selectedRoutes = selected
-}
-
-func (u *upstreamResolverBase) addRace(servers []netip.AddrPort) {
-	if len(servers) == 0 {
-		return
-	}
-	u.upstreamServers = append(u.upstreamServers, slices.Clone(servers))
 }
 
 // ServeDNS handles a DNS request
@@ -285,172 +235,107 @@ func (u *upstreamResolverBase) prepareRequest(r *dns.Msg) {
 }
 
 func (u *upstreamResolverBase) tryUpstreamServers(ctx context.Context, w dns.ResponseWriter, r *dns.Msg, logger *log.Entry) (bool, []upstreamFailure) {
-	groups := u.upstreamServers
-	switch len(groups) {
-	case 0:
-		return false, nil
-	case 1:
-		return u.tryOnlyRace(ctx, w, r, groups[0], logger)
-	default:
-		return u.raceAll(ctx, w, r, groups, logger)
-	}
-}
-
-func (u *upstreamResolverBase) tryOnlyRace(ctx context.Context, w dns.ResponseWriter, r *dns.Msg, group upstreamRace, logger *log.Entry) (bool, []upstreamFailure) {
-	res := u.tryRace(ctx, r, group)
-	if res.msg == nil {
-		return false, res.failures
-	}
-	u.writeSuccessResponse(w, res.msg, res.upstream, r.Question[0].Name, res.protocol, logger)
-	return true, res.failures
-}
-
-// raceAll runs one worker per group in parallel, taking the first valid
-// answer and cancelling the rest.
-func (u *upstreamResolverBase) raceAll(ctx context.Context, w dns.ResponseWriter, r *dns.Msg, groups []upstreamRace, logger *log.Entry) (bool, []upstreamFailure) {
-	raceCtx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	// Buffer sized to len(groups) so workers never block on send, even
-	// after the coordinator has returned.
-	results := make(chan raceResult, len(groups))
-	for _, g := range groups {
-		// tryRace clones the request per attempt, so workers never share
-		// a *dns.Msg and concurrent EDNS0 mutations can't race.
-		go func(g upstreamRace) {
-			results <- u.tryRace(raceCtx, r, g)
-		}(g)
+	timeout := u.upstreamTimeout
+	if len(u.upstreamServers) > 1 {
+		maxTotal := 5 * time.Second
+		minPerUpstream := 2 * time.Second
+		scaledTimeout := maxTotal / time.Duration(len(u.upstreamServers))
+		if scaledTimeout > minPerUpstream {
+			timeout = scaledTimeout
+		} else {
+			timeout = minPerUpstream
+		}
 	}
 
 	var failures []upstreamFailure
-	for range groups {
-		select {
-		case res := <-results:
-			failures = append(failures, res.failures...)
-			if res.msg != nil {
-				u.writeSuccessResponse(w, res.msg, res.upstream, r.Question[0].Name, res.protocol, logger)
-				return true, failures
-			}
-		case <-ctx.Done():
-			return false, failures
+	for _, upstream := range u.upstreamServers {
+		if failure := u.queryUpstream(ctx, w, r, upstream, timeout, logger); failure != nil {
+			failures = append(failures, *failure)
+		} else {
+			return true, failures
 		}
 	}
 	return false, failures
 }
 
-func (u *upstreamResolverBase) tryRace(ctx context.Context, r *dns.Msg, group upstreamRace) raceResult {
-	timeout := u.upstreamTimeout
-	if len(group) > 1 {
-		// Cap the whole walk at raceMaxTotalTimeout: per-upstream timeouts
-		// still honor raceMinPerUpstreamTimeout as a floor for correctness
-		// on slow links, but the outer context ensures the combined walk
-		// cannot exceed the cap regardless of group size.
-		timeout = max(raceMaxTotalTimeout/time.Duration(len(group)), raceMinPerUpstreamTimeout)
-		var cancel context.CancelFunc
-		ctx, cancel = context.WithTimeout(ctx, raceMaxTotalTimeout)
+// queryUpstream queries a single upstream server. Returns nil on success, or failure info to try next upstream.
+func (u *upstreamResolverBase) queryUpstream(parentCtx context.Context, w dns.ResponseWriter, r *dns.Msg, upstream netip.AddrPort, timeout time.Duration, logger *log.Entry) *upstreamFailure {
+	var rm *dns.Msg
+	var t time.Duration
+	var err error
+
+	// Advertise EDNS0 so the upstream may include Extended DNS Errors
+	// (RFC 8914) in failure responses; we use those to short-circuit
+	// failover for definitive answers like DNSSEC validation failures.
+	// Operate on a copy so the inbound request is unchanged: a client that
+	// did not advertise EDNS0 must not see an OPT in the response.
+	hadEdns := r.IsEdns0() != nil
+	reqUp := r
+	if !hadEdns {
+		reqUp = r.Copy()
+		reqUp.SetEdns0(upstreamUDPSize(), false)
+	}
+
+	var startTime time.Time
+	var upstreamProto *upstreamProtocolResult
+	func() {
+		ctx, cancel := context.WithTimeout(parentCtx, timeout)
 		defer cancel()
-	}
-
-	var failures []upstreamFailure
-	for _, upstream := range group {
-		if ctx.Err() != nil {
-			return raceResult{failures: failures}
-		}
-		// Clone the request per attempt: the exchange path mutates EDNS0
-		// options in-place, so reusing the same *dns.Msg across sequential
-		// upstreams would carry those mutations (e.g. a reduced UDP size)
-		// into the next attempt.
-		msg, proto, failure := u.queryUpstream(ctx, r.Copy(), upstream, timeout)
-		if failure != nil {
-			failures = append(failures, *failure)
-			continue
-		}
-		return raceResult{msg: msg, upstream: upstream, protocol: proto, failures: failures}
-	}
-	return raceResult{failures: failures}
-}
-
-func (u *upstreamResolverBase) queryUpstream(parentCtx context.Context, r *dns.Msg, upstream netip.AddrPort, timeout time.Duration) (*dns.Msg, string, *upstreamFailure) {
-	ctx, cancel := context.WithTimeout(parentCtx, timeout)
-	defer cancel()
-	ctx, upstreamProto := contextWithUpstreamProtocolResult(ctx)
-
-	startTime := time.Now()
-	rm, _, err := u.upstreamClient.exchange(ctx, upstream.String(), r)
+		ctx, upstreamProto = contextWithupstreamProtocolResult(ctx)
+		startTime = time.Now()
+		rm, t, err = u.upstreamClient.exchange(ctx, upstream.String(), reqUp)
+	}()
 
 	if err != nil {
-		// A parent cancellation (e.g., another race won and the coordinator
-		// cancelled the losers) is not an upstream failure. Check both the
-		// error chain and the parent context: a transport may surface the
-		// cancellation as a read/deadline error rather than context.Canceled.
-		if errors.Is(err, context.Canceled) || errors.Is(parentCtx.Err(), context.Canceled) {
-			return nil, "", &upstreamFailure{upstream: upstream, reason: "canceled"}
-		}
-		failure := u.handleUpstreamError(err, upstream, startTime)
-		u.markUpstreamFail(upstream, failure.reason)
-		return nil, "", failure
+		return u.handleUpstreamError(err, upstream, startTime)
 	}
 
 	if rm == nil || !rm.Response {
-		u.markUpstreamFail(upstream, "no response")
-		return nil, "", &upstreamFailure{upstream: upstream, reason: "no response"}
+		return &upstreamFailure{upstream: upstream, reason: "no response"}
 	}
 
 	if rm.Rcode == dns.RcodeServerFailure || rm.Rcode == dns.RcodeRefused {
-		reason := dns.RcodeToString[rm.Rcode]
-		u.markUpstreamFail(upstream, reason)
-		return nil, "", &upstreamFailure{upstream: upstream, reason: reason}
+		if code, ok := nonRetryableEDE(rm); ok {
+			resutil.SetMeta(w, "ede", edeName(code))
+			if !hadEdns {
+				stripOPT(rm)
+			}
+			u.writeSuccessResponse(w, rm, upstream, r.Question[0].Name, t, upstreamProto, logger)
+			return nil
+		}
+		return &upstreamFailure{upstream: upstream, reason: dns.RcodeToString[rm.Rcode]}
 	}
 
-	u.markUpstreamOk(upstream)
-
-	proto := ""
-	if upstreamProto != nil {
-		proto = upstreamProto.protocol
+	if !hadEdns {
+		stripOPT(rm)
 	}
-	return rm, proto, nil
+	u.writeSuccessResponse(w, rm, upstream, r.Question[0].Name, t, upstreamProto, logger)
+	return nil
 }
 
-// healthEntry returns the mutable health record for addr, lazily creating
-// the map and the entry. Caller must hold u.healthMu.
-func (u *upstreamResolverBase) healthEntry(addr netip.AddrPort) *UpstreamHealth {
-	if u.health == nil {
-		u.health = make(map[netip.AddrPort]*UpstreamHealth)
+// upstreamUDPSize returns the EDNS0 UDP buffer size we advertise to upstreams,
+// derived from the tunnel MTU and bounded against underflow.
+func upstreamUDPSize() uint16 {
+	if currentMTU > ipUDPHeaderSize {
+		return currentMTU - ipUDPHeaderSize
 	}
-	h := u.health[addr]
-	if h == nil {
-		h = &UpstreamHealth{}
-		u.health[addr] = h
-	}
-	return h
+	return dns.MinMsgSize
 }
 
-func (u *upstreamResolverBase) markUpstreamOk(addr netip.AddrPort) {
-	u.healthMu.Lock()
-	defer u.healthMu.Unlock()
-	h := u.healthEntry(addr)
-	h.LastOk = time.Now()
-	h.LastFail = time.Time{}
-	h.LastErr = ""
-}
-
-func (u *upstreamResolverBase) markUpstreamFail(addr netip.AddrPort, reason string) {
-	u.healthMu.Lock()
-	defer u.healthMu.Unlock()
-	h := u.healthEntry(addr)
-	h.LastFail = time.Now()
-	h.LastErr = reason
-}
-
-// UpstreamHealth returns a snapshot of per-upstream query outcomes.
-func (u *upstreamResolverBase) UpstreamHealth() map[netip.AddrPort]UpstreamHealth {
-	u.healthMu.RLock()
-	defer u.healthMu.RUnlock()
-	out := make(map[netip.AddrPort]UpstreamHealth, len(u.health))
-	for k, v := range u.health {
-		out[k] = *v
+// stripOPT removes any OPT pseudo-RRs from the response's Extra section so
+// the response complies with RFC 6891 when the client did not advertise EDNS0.
+func stripOPT(rm *dns.Msg) {
+	if len(rm.Extra) == 0 {
+		return
 	}
-	return out
+	out := rm.Extra[:0]
+	for _, rr := range rm.Extra {
+		if _, ok := rr.(*dns.OPT); ok {
+			continue
+		}
+		out = append(out, rr)
+	}
+	rm.Extra = out
 }
 
 func (u *upstreamResolverBase) handleUpstreamError(err error, upstream netip.AddrPort, startTime time.Time) *upstreamFailure {
@@ -466,23 +351,12 @@ func (u *upstreamResolverBase) handleUpstreamError(err error, upstream netip.Add
 	return &upstreamFailure{upstream: upstream, reason: reason}
 }
 
-func (u *upstreamResolverBase) debugUpstreamTimeout(upstream netip.AddrPort) string {
-	if u.statusRecorder == nil {
-		return ""
-	}
+func (u *upstreamResolverBase) writeSuccessResponse(w dns.ResponseWriter, rm *dns.Msg, upstream netip.AddrPort, domain string, t time.Duration, upstreamProto *upstreamProtocolResult, logger *log.Entry) bool {
+	u.successCount.Add(1)
 
-	peerInfo := findPeerForIP(upstream.Addr(), u.statusRecorder)
-	if peerInfo == nil {
-		return ""
-	}
-
-	return fmt.Sprintf("(routes through NetBird peer %s)", FormatPeerStatus(peerInfo))
-}
-
-func (u *upstreamResolverBase) writeSuccessResponse(w dns.ResponseWriter, rm *dns.Msg, upstream netip.AddrPort, domain string, proto string, logger *log.Entry) {
 	resutil.SetMeta(w, "upstream", upstream.String())
-	if proto != "" {
-		resutil.SetMeta(w, "upstream_protocol", proto)
+	if upstreamProto != nil && upstreamProto.protocol != "" {
+		resutil.SetMeta(w, "upstream_protocol", upstreamProto.protocol)
 	}
 
 	// Clear Zero bit from external responses to prevent upstream servers from
@@ -491,11 +365,14 @@ func (u *upstreamResolverBase) writeSuccessResponse(w dns.ResponseWriter, rm *dn
 
 	if err := w.WriteMsg(rm); err != nil {
 		logger.Errorf("failed to write DNS response for question domain=%s: %s", domain, err)
+		return true
 	}
+
+	return true
 }
 
 func (u *upstreamResolverBase) logUpstreamFailures(domain string, failures []upstreamFailure, succeeded bool, logger *log.Entry) {
-	totalUpstreams := len(u.flatUpstreams())
+	totalUpstreams := len(u.upstreamServers)
 	failedCount := len(failures)
 	failureSummary := formatFailures(failures)
 
@@ -522,6 +399,147 @@ func formatFailures(failures []upstreamFailure) string {
 	return strings.Join(parts, ", ")
 }
 
+// nonRetryableEDE returns the first non-retryable EDE code carried in the
+// response, if any.
+func nonRetryableEDE(rm *dns.Msg) (uint16, bool) {
+	opt := rm.IsEdns0()
+	if opt == nil {
+		return 0, false
+	}
+	for _, o := range opt.Option {
+		ede, ok := o.(*dns.EDNS0_EDE)
+		if !ok {
+			continue
+		}
+		if _, ok := nonRetryableEDECodes[ede.InfoCode]; ok {
+			return ede.InfoCode, true
+		}
+	}
+	return 0, false
+}
+
+// edeName returns a human-readable name for an EDE code, falling back to
+// the numeric code when unknown.
+func edeName(code uint16) string {
+	if name, ok := dns.ExtendedErrorCodeToString[code]; ok {
+		return name
+	}
+	return fmt.Sprintf("EDE %d", code)
+}
+
+// ProbeAvailability tests all upstream servers simultaneously and
+// disables the resolver if none work
+func (u *upstreamResolverBase) ProbeAvailability(ctx context.Context) {
+	u.mutex.Lock()
+	defer u.mutex.Unlock()
+
+	// avoid probe if upstreams could resolve at least one query
+	if u.successCount.Load() > 0 {
+		return
+	}
+
+	var success bool
+	var mu sync.Mutex
+	var wg sync.WaitGroup
+
+	var errs *multierror.Error
+	for _, upstream := range u.upstreamServers {
+		wg.Add(1)
+		go func(upstream netip.AddrPort) {
+			defer wg.Done()
+			err := u.testNameserver(u.ctx, ctx, upstream, 500*time.Millisecond)
+			if err != nil {
+				mu.Lock()
+				errs = multierror.Append(errs, err)
+				mu.Unlock()
+				log.Warnf("probing upstream nameserver %s: %s", upstream, err)
+				return
+			}
+
+			mu.Lock()
+			success = true
+			mu.Unlock()
+		}(upstream)
+	}
+
+	wg.Wait()
+
+	select {
+	case <-ctx.Done():
+		return
+	case <-u.ctx.Done():
+		return
+	default:
+	}
+
+	// didn't find a working upstream server, let's disable and try later
+	if !success {
+		u.disable(errs.ErrorOrNil())
+
+		if u.statusRecorder == nil {
+			return
+		}
+
+		u.statusRecorder.PublishEvent(
+			proto.SystemEvent_WARNING,
+			proto.SystemEvent_DNS,
+			"All upstream servers failed (probe failed)",
+			"Unable to reach one or more DNS servers. This might affect your ability to connect to some services.",
+			map[string]string{"upstreams": u.upstreamServersString()},
+		)
+	}
+}
+
+// waitUntilResponse retries, in an exponential interval, querying the upstream servers until it gets a positive response
+func (u *upstreamResolverBase) waitUntilResponse() {
+	exponentialBackOff := &backoff.ExponentialBackOff{
+		InitialInterval:     500 * time.Millisecond,
+		RandomizationFactor: 0.5,
+		Multiplier:          1.1,
+		MaxInterval:         u.reactivatePeriod,
+		MaxElapsedTime:      0,
+		Stop:                backoff.Stop,
+		Clock:               backoff.SystemClock,
+	}
+
+	operation := func() error {
+		select {
+		case <-u.ctx.Done():
+			return backoff.Permanent(fmt.Errorf("exiting upstream retry loop for upstreams %s: parent context has been canceled", u.upstreamServersString()))
+		default:
+		}
+
+		for _, upstream := range u.upstreamServers {
+			if err := u.testNameserver(u.ctx, nil, upstream, probeTimeout); err != nil {
+				log.Tracef("upstream check for %s: %s", upstream, err)
+			} else {
+				// at least one upstream server is available, stop probing
+				return nil
+			}
+		}
+
+		log.Tracef("checking connectivity with upstreams %s failed. Retrying in %s", u.upstreamServersString(), exponentialBackOff.NextBackOff())
+		return fmt.Errorf("upstream check call error")
+	}
+
+	err := backoff.Retry(operation, backoff.WithContext(exponentialBackOff, u.ctx))
+	if err != nil {
+		if errors.Is(err, context.Canceled) {
+			log.Debugf("upstream retry loop exited for upstreams %s", u.upstreamServersString())
+		} else {
+			log.Warnf("upstream retry loop exited for upstreams %s: %v", u.upstreamServersString(), err)
+		}
+		return
+	}
+
+	log.Infof("upstreams %s are responsive again. Adding them back to system", u.upstreamServersString())
+	u.successCount.Add(1)
+	u.reactivate()
+	u.mutex.Lock()
+	u.disabled = false
+	u.mutex.Unlock()
+}
+
 // isTimeout returns true if the given error is a network timeout error.
 //
 // Copied from k8s.io/apimachinery/pkg/util/net.IsTimeout
@@ -533,6 +551,45 @@ func isTimeout(err error) bool {
 	return false
 }
 
+func (u *upstreamResolverBase) disable(err error) {
+	if u.disabled {
+		return
+	}
+
+	log.Warnf("Upstream resolving is Disabled for %v", reactivatePeriod)
+	u.successCount.Store(0)
+	u.deactivate(err)
+	u.disabled = true
+	u.wg.Add(1)
+	go func() {
+		defer u.wg.Done()
+		u.waitUntilResponse()
+	}()
+}
+
+func (u *upstreamResolverBase) upstreamServersString() string {
+	var servers []string
+	for _, server := range u.upstreamServers {
+		servers = append(servers, server.String())
+	}
+	return strings.Join(servers, ", ")
+}
+
+func (u *upstreamResolverBase) testNameserver(baseCtx context.Context, externalCtx context.Context, server netip.AddrPort, timeout time.Duration) error {
+	mergedCtx, cancel := context.WithTimeout(baseCtx, timeout)
+	defer cancel()
+
+	if externalCtx != nil {
+		stop2 := context.AfterFunc(externalCtx, cancel)
+		defer stop2()
+	}
+
+	r := new(dns.Msg).SetQuestion(testRecord, dns.TypeSOA)
+
+	_, _, err := u.upstreamClient.exchange(mergedCtx, server.String(), r)
+	return err
+}
+
 // clientUDPMaxSize returns the maximum UDP response size the client accepts.
 func clientUDPMaxSize(r *dns.Msg) int {
 	if opt := r.IsEdns0(); opt != nil {
@@ -544,10 +601,13 @@ func clientUDPMaxSize(r *dns.Msg) int {
 // ExchangeWithFallback exchanges a DNS message with the upstream server.
 // It first tries to use UDP, and if it is truncated, it falls back to TCP.
 // If the inbound request came over TCP (via context), it skips the UDP attempt.
+// If the passed context is nil, this will use Exchange instead of ExchangeContext.
 func ExchangeWithFallback(ctx context.Context, client *dns.Client, r *dns.Msg, upstream string) (*dns.Msg, time.Duration, error) {
 	// If the request came in over TCP, go straight to TCP upstream.
 	if dnsProtocolFromContext(ctx) == protoTCP {
-		rm, t, err := toTCPClient(client).ExchangeContext(ctx, r, upstream)
+		tcpClient := *client
+		tcpClient.Net = protoTCP
+		rm, t, err := tcpClient.ExchangeContext(ctx, r, upstream)
 		if err != nil {
 			return nil, t, fmt.Errorf("with tcp: %w", err)
 		}
@@ -567,7 +627,18 @@ func ExchangeWithFallback(ctx context.Context, client *dns.Client, r *dns.Msg, u
 		opt.SetUDPSize(maxUDPPayload)
 	}
 
-	rm, t, err := client.ExchangeContext(ctx, r, upstream)
+	var (
+		rm  *dns.Msg
+		t   time.Duration
+		err error
+	)
+
+	if ctx == nil {
+		rm, t, err = client.Exchange(r, upstream)
+	} else {
+		rm, t, err = client.ExchangeContext(ctx, r, upstream)
+	}
+
 	if err != nil {
 		return nil, t, fmt.Errorf("with udp: %w", err)
 	}
@@ -581,7 +652,15 @@ func ExchangeWithFallback(ctx context.Context, client *dns.Client, r *dns.Msg, u
 	// data than the client's buffer, we could truncate locally and skip
 	// the TCP retry.
 
-	rm, t, err = toTCPClient(client).ExchangeContext(ctx, r, upstream)
+	tcpClient := *client
+	tcpClient.Net = protoTCP
+
+	if ctx == nil {
+		rm, t, err = tcpClient.Exchange(r, upstream)
+	} else {
+		rm, t, err = tcpClient.ExchangeContext(ctx, r, upstream)
+	}
+
 	if err != nil {
 		return nil, t, fmt.Errorf("with tcp: %w", err)
 	}
@@ -595,25 +674,6 @@ func ExchangeWithFallback(ctx context.Context, client *dns.Client, r *dns.Msg, u
 	return rm, t, nil
 }
 
-// toTCPClient returns a copy of c configured for TCP. If c's Dialer has a
-// *net.UDPAddr bound as LocalAddr (iOS does this to keep the source IP on
-// the tunnel interface), it is converted to the equivalent *net.TCPAddr
-// so net.Dialer doesn't reject the TCP dial with "mismatched local
-// address type".
-func toTCPClient(c *dns.Client) *dns.Client {
-	tcp := *c
-	tcp.Net = protoTCP
-	if tcp.Dialer == nil {
-		return &tcp
-	}
-	d := *tcp.Dialer
-	if ua, ok := d.LocalAddr.(*net.UDPAddr); ok {
-		d.LocalAddr = &net.TCPAddr{IP: ua.IP, Port: ua.Port, Zone: ua.Zone}
-	}
-	tcp.Dialer = &d
-	return &tcp
-}
-
 // ExchangeWithNetstack performs a DNS exchange using netstack for dialing.
 // This is needed when netstack is enabled to reach peer IPs through the tunnel.
 func ExchangeWithNetstack(ctx context.Context, nsNet *netstack.Net, r *dns.Msg, upstream string) (*dns.Msg, error) {
@@ -755,36 +815,15 @@ func findPeerForIP(ip netip.Addr, statusRecorder *peer.Status) *peer.State {
 	return bestMatch
 }
 
-// haMapRouteCount returns the total number of routes across all HA
-// groups in the map. route.HAMap is keyed by HAUniqueID with slices of
-// routes per key, so len(hm) is the number of HA groups, not routes.
-func haMapRouteCount(hm route.HAMap) int {
-	total := 0
-	for _, routes := range hm {
-		total += len(routes)
+func (u *upstreamResolverBase) debugUpstreamTimeout(upstream netip.AddrPort) string {
+	if u.statusRecorder == nil {
+		return ""
 	}
-	return total
-}
 
-// haMapContains checks whether ip is covered by any concrete prefix in
-// the HA map. haveDynamic is reported separately: dynamic (domain-based)
-// routes carry a placeholder Network that can't be prefix-checked, so we
-// can't know at this point whether ip is reached through one. Callers
-// decide how to interpret the unknown: health projection treats it as
-// "possibly routed" to avoid emitting false-positive warnings during
-// startup, while iOS dial selection requires a concrete match before
-// binding to the tunnel.
-func haMapContains(hm route.HAMap, ip netip.Addr) (matched, haveDynamic bool) {
-	for _, routes := range hm {
-		for _, r := range routes {
-			if r.IsDynamic() {
-				haveDynamic = true
-				continue
-			}
-			if r.Network.Contains(ip) {
-				return true, haveDynamic
-			}
-		}
+	peerInfo := findPeerForIP(upstream.Addr(), u.statusRecorder)
+	if peerInfo == nil {
+		return ""
 	}
-	return false, haveDynamic
+
+	return fmt.Sprintf("(routes through NetBird peer %s)", FormatPeerStatus(peerInfo))
 }

client/internal/dns/upstream_android.go

@@ -11,7 +11,6 @@ import (
 
 	"github.com/netbirdio/netbird/client/internal/peer"
 	nbnet "github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
 type upstreamResolver struct {
@@ -27,9 +26,9 @@ func newUpstreamResolver(
 	_ WGIface,
 	statusRecorder *peer.Status,
 	hostsDNSHolder *hostsDNSHolder,
-	d domain.Domain,
+	domain string,
 ) (*upstreamResolver, error) {
-	upstreamResolverBase := newUpstreamResolverBase(ctx, statusRecorder, d)
+	upstreamResolverBase := newUpstreamResolverBase(ctx, statusRecorder, domain)
 	c := &upstreamResolver{
 		upstreamResolverBase: upstreamResolverBase,
 		hostsDNSHolder:       hostsDNSHolder,

client/internal/dns/upstream_general.go

@@ -12,7 +12,6 @@ import (
 	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
 type upstreamResolver struct {
@@ -25,9 +24,9 @@ func newUpstreamResolver(
 	wgIface WGIface,
 	statusRecorder *peer.Status,
 	_ *hostsDNSHolder,
-	d domain.Domain,
+	domain string,
 ) (*upstreamResolver, error) {
-	upstreamResolverBase := newUpstreamResolverBase(ctx, statusRecorder, d)
+	upstreamResolverBase := newUpstreamResolverBase(ctx, statusRecorder, domain)
 	nonIOS := &upstreamResolver{
 		upstreamResolverBase: upstreamResolverBase,
 		nsNet:                wgIface.GetNet(),

client/internal/dns/upstream_ios.go

@@ -15,7 +15,6 @@ import (
 	"golang.org/x/sys/unix"
 
 	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
 type upstreamResolverIOS struct {
@@ -30,9 +29,9 @@ func newUpstreamResolver(
 	wgIface WGIface,
 	statusRecorder *peer.Status,
 	_ *hostsDNSHolder,
-	d domain.Domain,
+	domain string,
 ) (*upstreamResolverIOS, error) {
-	upstreamResolverBase := newUpstreamResolverBase(ctx, statusRecorder, d)
+	upstreamResolverBase := newUpstreamResolverBase(ctx, statusRecorder, domain)
 
 	ios := &upstreamResolverIOS{
 		upstreamResolverBase: upstreamResolverBase,
@@ -66,14 +65,8 @@ func (u *upstreamResolverIOS) exchange(ctx context.Context, upstream string, r *
 	} else {
 		upstreamIP = upstreamIP.Unmap()
 	}
-	var routed bool
-	if u.selectedRoutes != nil {
-		// Only a concrete prefix match binds to the tunnel: dialing
-		// through a private client for an upstream we can't prove is
-		// routed would break public resolvers.
-		routed, _ = haMapContains(u.selectedRoutes(), upstreamIP)
-	}
-	needsPrivate := u.lNet.Contains(upstreamIP) || routed
+	needsPrivate := u.lNet.Contains(upstreamIP) ||
+		(u.routeMatch != nil && u.routeMatch(upstreamIP))
 	if needsPrivate {
 		log.Debugf("using private client to query %s via upstream %s", r.Question[0].Name, upstream)
 		client, err = GetClientPrivate(u.lIP, u.interfaceName, timeout)
@@ -82,7 +75,8 @@ func (u *upstreamResolverIOS) exchange(ctx context.Context, upstream string, r *
 		}
 	}
 
-	return ExchangeWithFallback(ctx, client, r, upstream)
+	// Cannot use client.ExchangeContext because it overwrites our Dialer
+	return ExchangeWithFallback(nil, client, r, upstream)
 }
 
 // GetClientPrivate returns a new DNS client bound to the local IP address of the Netbird interface

client/internal/dns/upstream_test.go

@@ -6,7 +6,6 @@ import (
 	"net"
 	"net/netip"
 	"strings"
-	"sync/atomic"
 	"testing"
 	"time"
 
@@ -74,7 +73,7 @@ func TestUpstreamResolver_ServeDNS(t *testing.T) {
 					servers = append(servers, netip.AddrPortFrom(addrPort.Addr().Unmap(), addrPort.Port()))
 				}
 			}
-			resolver.addRace(servers)
+			resolver.upstreamServers = servers
 			resolver.upstreamTimeout = testCase.timeout
 			if testCase.cancelCTX {
 				cancel()
@@ -133,10 +132,20 @@ func (m *mockNetstackProvider) GetInterfaceGUIDString() (string, error) {
 	return "", nil
 }
 
+type mockUpstreamResolver struct {
+	r   *dns.Msg
+	rtt time.Duration
+	err error
+}
+
+// exchange mock implementation of exchange from upstreamResolver
+func (c mockUpstreamResolver) exchange(_ context.Context, _ string, _ *dns.Msg) (*dns.Msg, time.Duration, error) {
+	return c.r, c.rtt, c.err
+}
+
 type mockUpstreamResponse struct {
-	msg   *dns.Msg
-	err   error
-	delay time.Duration
+	msg *dns.Msg
+	err error
 }
 
 type mockUpstreamResolverPerServer struct {
@@ -144,19 +153,63 @@ type mockUpstreamResolverPerServer struct {
 	rtt       time.Duration
 }
 
-func (c mockUpstreamResolverPerServer) exchange(ctx context.Context, upstream string, _ *dns.Msg) (*dns.Msg, time.Duration, error) {
-	r, ok := c.responses[upstream]
-	if !ok {
-		return nil, c.rtt, fmt.Errorf("no mock response for %s", upstream)
+func (c mockUpstreamResolverPerServer) exchange(_ context.Context, upstream string, _ *dns.Msg) (*dns.Msg, time.Duration, error) {
+	if r, ok := c.responses[upstream]; ok {
+		return r.msg, c.rtt, r.err
 	}
-	if r.delay > 0 {
-		select {
-		case <-time.After(r.delay):
-		case <-ctx.Done():
-			return nil, c.rtt, ctx.Err()
-		}
+	return nil, c.rtt, fmt.Errorf("no mock response for %s", upstream)
+}
+
+func TestUpstreamResolver_DeactivationReactivation(t *testing.T) {
+	mockClient := &mockUpstreamResolver{
+		err: dns.ErrTime,
+		r:   new(dns.Msg),
+		rtt: time.Millisecond,
+	}
+
+	resolver := &upstreamResolverBase{
+		ctx:              context.TODO(),
+		upstreamClient:   mockClient,
+		upstreamTimeout:  UpstreamTimeout,
+		reactivatePeriod: time.Microsecond * 100,
+	}
+	addrPort, _ := netip.ParseAddrPort("0.0.0.0:1") // Use valid port for parsing, test will still fail on connection
+	resolver.upstreamServers = []netip.AddrPort{netip.AddrPortFrom(addrPort.Addr().Unmap(), addrPort.Port())}
+
+	failed := false
+	resolver.deactivate = func(error) {
+		failed = true
+		// After deactivation, make the mock client work again
+		mockClient.err = nil
+	}
+
+	reactivated := false
+	resolver.reactivate = func() {
+		reactivated = true
+	}
+
+	resolver.ProbeAvailability(context.TODO())
+
+	if !failed {
+		t.Errorf("expected that resolving was deactivated")
+		return
+	}
+
+	if !resolver.disabled {
+		t.Errorf("resolver should be Disabled")
+		return
+	}
+
+	time.Sleep(time.Millisecond * 200)
+
+	if !reactivated {
+		t.Errorf("expected that resolving was reactivated")
+		return
+	}
+
+	if resolver.disabled {
+		t.Errorf("should be enabled")
 	}
-	return r.msg, c.rtt, r.err
 }
 
 func TestUpstreamResolver_Failover(t *testing.T) {
@@ -286,9 +339,9 @@ func TestUpstreamResolver_Failover(t *testing.T) {
 			resolver := &upstreamResolverBase{
 				ctx:             ctx,
 				upstreamClient:  trackingClient,
+				upstreamServers: []netip.AddrPort{upstream1, upstream2},
 				upstreamTimeout: UpstreamTimeout,
 			}
-			resolver.addRace([]netip.AddrPort{upstream1, upstream2})
 
 			var responseMSG *dns.Msg
 			responseWriter := &test.MockResponseWriter{
@@ -368,9 +421,9 @@ func TestUpstreamResolver_SingleUpstreamFailure(t *testing.T) {
 	resolver := &upstreamResolverBase{
 		ctx:             ctx,
 		upstreamClient:  mockClient,
+		upstreamServers: []netip.AddrPort{upstream},
 		upstreamTimeout: UpstreamTimeout,
 	}
-	resolver.addRace([]netip.AddrPort{upstream})
 
 	var responseMSG *dns.Msg
 	responseWriter := &test.MockResponseWriter{
@@ -387,136 +440,6 @@ func TestUpstreamResolver_SingleUpstreamFailure(t *testing.T) {
 	assert.Equal(t, dns.RcodeServerFailure, responseMSG.Rcode, "single upstream SERVFAIL should return SERVFAIL")
 }
 
-// TestUpstreamResolver_RaceAcrossGroups covers two nameserver groups
-// configured for the same domain, with one broken group. The merge+race
-// path should answer as fast as the working group and not pay the timeout
-// of the broken one on every query.
-func TestUpstreamResolver_RaceAcrossGroups(t *testing.T) {
-	broken := netip.MustParseAddrPort("192.0.2.1:53")
-	working := netip.MustParseAddrPort("192.0.2.2:53")
-	successAnswer := "192.0.2.100"
-	timeoutErr := &net.OpError{Op: "read", Err: fmt.Errorf("i/o timeout")}
-
-	mockClient := &mockUpstreamResolverPerServer{
-		responses: map[string]mockUpstreamResponse{
-			// Force the broken upstream to only unblock via timeout /
-			// cancellation so the assertion below can't pass if races
-			// were run serially.
-			broken.String():  {err: timeoutErr, delay: 500 * time.Millisecond},
-			working.String(): {msg: buildMockResponse(dns.RcodeSuccess, successAnswer)},
-		},
-		rtt: time.Millisecond,
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	resolver := &upstreamResolverBase{
-		ctx:             ctx,
-		upstreamClient:  mockClient,
-		upstreamTimeout: 250 * time.Millisecond,
-	}
-	resolver.addRace([]netip.AddrPort{broken})
-	resolver.addRace([]netip.AddrPort{working})
-
-	var responseMSG *dns.Msg
-	responseWriter := &test.MockResponseWriter{
-		WriteMsgFunc: func(m *dns.Msg) error {
-			responseMSG = m
-			return nil
-		},
-	}
-
-	inputMSG := new(dns.Msg).SetQuestion("example.com.", dns.TypeA)
-	start := time.Now()
-	resolver.ServeDNS(responseWriter, inputMSG)
-	elapsed := time.Since(start)
-
-	require.NotNil(t, responseMSG, "should write a response")
-	assert.Equal(t, dns.RcodeSuccess, responseMSG.Rcode)
-	require.NotEmpty(t, responseMSG.Answer)
-	assert.Contains(t, responseMSG.Answer[0].String(), successAnswer)
-	// Working group answers in a single RTT; the broken group's
-	// timeout (100ms) must not block the response.
-	assert.Less(t, elapsed, 100*time.Millisecond, "race must not wait for broken group's timeout")
-}
-
-// TestUpstreamResolver_AllGroupsFail checks that when every group fails the
-// resolver returns SERVFAIL rather than leaking a partial response.
-func TestUpstreamResolver_AllGroupsFail(t *testing.T) {
-	a := netip.MustParseAddrPort("192.0.2.1:53")
-	b := netip.MustParseAddrPort("192.0.2.2:53")
-
-	mockClient := &mockUpstreamResolverPerServer{
-		responses: map[string]mockUpstreamResponse{
-			a.String(): {msg: buildMockResponse(dns.RcodeServerFailure, "")},
-			b.String(): {msg: buildMockResponse(dns.RcodeServerFailure, "")},
-		},
-		rtt: time.Millisecond,
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	resolver := &upstreamResolverBase{
-		ctx:             ctx,
-		upstreamClient:  mockClient,
-		upstreamTimeout: UpstreamTimeout,
-	}
-	resolver.addRace([]netip.AddrPort{a})
-	resolver.addRace([]netip.AddrPort{b})
-
-	var responseMSG *dns.Msg
-	responseWriter := &test.MockResponseWriter{
-		WriteMsgFunc: func(m *dns.Msg) error {
-			responseMSG = m
-			return nil
-		},
-	}
-
-	resolver.ServeDNS(responseWriter, new(dns.Msg).SetQuestion("example.com.", dns.TypeA))
-	require.NotNil(t, responseMSG)
-	assert.Equal(t, dns.RcodeServerFailure, responseMSG.Rcode)
-}
-
-// TestUpstreamResolver_HealthTracking verifies that query-path results are
-// recorded into per-upstream health, which is what projects back to
-// NSGroupState for status reporting.
-func TestUpstreamResolver_HealthTracking(t *testing.T) {
-	ok := netip.MustParseAddrPort("192.0.2.10:53")
-	bad := netip.MustParseAddrPort("192.0.2.11:53")
-
-	mockClient := &mockUpstreamResolverPerServer{
-		responses: map[string]mockUpstreamResponse{
-			ok.String():  {msg: buildMockResponse(dns.RcodeSuccess, "192.0.2.100")},
-			bad.String(): {msg: buildMockResponse(dns.RcodeServerFailure, "")},
-		},
-		rtt: time.Millisecond,
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	resolver := &upstreamResolverBase{
-		ctx:             ctx,
-		upstreamClient:  mockClient,
-		upstreamTimeout: UpstreamTimeout,
-	}
-	resolver.addRace([]netip.AddrPort{ok, bad})
-
-	responseWriter := &test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { return nil }}
-	resolver.ServeDNS(responseWriter, new(dns.Msg).SetQuestion("example.com.", dns.TypeA))
-
-	health := resolver.UpstreamHealth()
-	require.Contains(t, health, ok)
-	assert.False(t, health[ok].LastOk.IsZero(), "ok upstream should have LastOk set")
-	assert.Empty(t, health[ok].LastErr)
-
-	// bad upstream was never tried because ok answered first; its health
-	// should remain unset.
-	assert.NotContains(t, health, bad, "sibling upstream should not be queried when primary answers")
-}
-
 func TestFormatFailures(t *testing.T) {
 	testCases := []struct {
 		name     string
@@ -742,10 +665,10 @@ func TestExchangeWithFallback_EDNS0Capped(t *testing.T) {
 	// Verify that a client EDNS0 larger than our MTU-derived limit gets
 	// capped in the outgoing request so the upstream doesn't send a
 	// response larger than our read buffer.
-	var receivedUDPSize atomic.Uint32
+	var receivedUDPSize uint16
 	udpHandler := dns.HandlerFunc(func(w dns.ResponseWriter, r *dns.Msg) {
 		if opt := r.IsEdns0(); opt != nil {
-			receivedUDPSize.Store(uint32(opt.UDPSize()))
+			receivedUDPSize = opt.UDPSize()
 		}
 		m := new(dns.Msg)
 		m.SetReply(r)
@@ -776,7 +699,7 @@ func TestExchangeWithFallback_EDNS0Capped(t *testing.T) {
 	require.NotNil(t, rm)
 
 	expectedMax := uint16(currentMTU - ipUDPHeaderSize)
-	assert.Equal(t, expectedMax, uint16(receivedUDPSize.Load()),
+	assert.Equal(t, expectedMax, receivedUDPSize,
 		"upstream should see capped EDNS0, not the client's 4096")
 }
 
@@ -847,3 +770,132 @@ func TestExchangeWithFallback_TCPTruncatesToClientSize(t *testing.T) {
 	assert.Less(t, len(rm2.Answer), 20, "small EDNS0 client should get fewer records")
 	assert.True(t, rm2.Truncated, "response should be truncated for small buffer client")
 }
+
+func msgWithEDE(rcode int, codes ...uint16) *dns.Msg {
+	m := new(dns.Msg)
+	m.Response = true
+	m.Rcode = rcode
+	if len(codes) == 0 {
+		return m
+	}
+	opt := &dns.OPT{Hdr: dns.RR_Header{Name: ".", Rrtype: dns.TypeOPT}}
+	opt.SetUDPSize(dns.MinMsgSize)
+	for _, c := range codes {
+		opt.Option = append(opt.Option, &dns.EDNS0_EDE{InfoCode: c})
+	}
+	m.Extra = append(m.Extra, opt)
+	return m
+}
+
+func TestNonRetryableEDE(t *testing.T) {
+	tests := []struct {
+		name     string
+		msg      *dns.Msg
+		wantOK   bool
+		wantCode uint16
+	}{
+		{name: "no edns0", msg: msgWithEDE(dns.RcodeServerFailure)},
+		{
+			name: "opt without ede",
+			msg: func() *dns.Msg {
+				m := msgWithEDE(dns.RcodeServerFailure)
+				opt := &dns.OPT{Hdr: dns.RR_Header{Name: ".", Rrtype: dns.TypeOPT}}
+				opt.Option = append(opt.Option, &dns.EDNS0_NSID{Code: dns.EDNS0NSID})
+				m.Extra = []dns.RR{opt}
+				return m
+			}(),
+		},
+		{name: "ede dnsbogus", msg: msgWithEDE(dns.RcodeServerFailure, dns.ExtendedErrorCodeDNSBogus), wantOK: true, wantCode: dns.ExtendedErrorCodeDNSBogus},
+		{name: "ede signature expired", msg: msgWithEDE(dns.RcodeServerFailure, dns.ExtendedErrorCodeSignatureExpired), wantOK: true, wantCode: dns.ExtendedErrorCodeSignatureExpired},
+		{name: "ede blocked", msg: msgWithEDE(dns.RcodeServerFailure, dns.ExtendedErrorCodeBlocked), wantOK: true, wantCode: dns.ExtendedErrorCodeBlocked},
+		{name: "ede prohibited", msg: msgWithEDE(dns.RcodeRefused, dns.ExtendedErrorCodeProhibited), wantOK: true, wantCode: dns.ExtendedErrorCodeProhibited},
+		{name: "ede cached error retryable", msg: msgWithEDE(dns.RcodeServerFailure, dns.ExtendedErrorCodeCachedError)},
+		{name: "ede network error retryable", msg: msgWithEDE(dns.RcodeServerFailure, dns.ExtendedErrorCodeNetworkError)},
+		{name: "ede not ready retryable", msg: msgWithEDE(dns.RcodeServerFailure, dns.ExtendedErrorCodeNotReady)},
+		{
+			name:     "first non-retryable wins",
+			msg:      msgWithEDE(dns.RcodeServerFailure, dns.ExtendedErrorCodeNetworkError, dns.ExtendedErrorCodeDNSBogus),
+			wantOK:   true,
+			wantCode: dns.ExtendedErrorCodeDNSBogus,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			code, ok := nonRetryableEDE(tc.msg)
+			assert.Equal(t, tc.wantOK, ok, "ok should match")
+			if tc.wantOK {
+				assert.Equal(t, tc.wantCode, code, "code should match")
+			}
+		})
+	}
+}
+
+func TestEDEName(t *testing.T) {
+	assert.Equal(t, "DNSSEC Bogus", edeName(dns.ExtendedErrorCodeDNSBogus))
+	assert.Equal(t, "Signature Expired", edeName(dns.ExtendedErrorCodeSignatureExpired))
+	assert.Equal(t, "EDE 9999", edeName(9999), "unknown code falls back to numeric")
+}
+
+func TestStripOPT(t *testing.T) {
+	rm := &dns.Msg{
+		Extra: []dns.RR{
+			&dns.OPT{Hdr: dns.RR_Header{Name: ".", Rrtype: dns.TypeOPT}},
+			&dns.A{Hdr: dns.RR_Header{Name: "x.", Rrtype: dns.TypeA}, A: net.IPv4(1, 2, 3, 4)},
+		},
+	}
+	stripOPT(rm)
+	assert.Len(t, rm.Extra, 1, "OPT should be removed, A kept")
+	_, isOPT := rm.Extra[0].(*dns.OPT)
+	assert.False(t, isOPT, "remaining record must not be OPT")
+}
+
+func TestUpstreamResolver_NonRetryableEDEShortCircuits(t *testing.T) {
+	upstream1 := netip.MustParseAddrPort("192.0.2.1:53")
+	upstream2 := netip.MustParseAddrPort("192.0.2.2:53")
+
+	servfailWithEDE := msgWithEDE(dns.RcodeServerFailure, dns.ExtendedErrorCodeDNSBogus)
+	successResp := buildMockResponse(dns.RcodeSuccess, "192.0.2.100")
+
+	var queried []string
+	tracking := &trackingMockClient{
+		inner: &mockUpstreamResolverPerServer{
+			responses: map[string]mockUpstreamResponse{
+				upstream1.String(): {msg: servfailWithEDE},
+				upstream2.String(): {msg: successResp},
+			},
+			rtt: time.Millisecond,
+		},
+		queriedUpstreams: &queried,
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	resolver := &upstreamResolverBase{
+		ctx:             ctx,
+		upstreamClient:  tracking,
+		upstreamServers: []netip.AddrPort{upstream1, upstream2},
+		upstreamTimeout: UpstreamTimeout,
+	}
+
+	var written *dns.Msg
+	w := &test.MockResponseWriter{
+		WriteMsgFunc: func(m *dns.Msg) error {
+			written = m
+			return nil
+		},
+	}
+
+	// Client query without EDNS0 must not see an OPT in the response.
+	q := new(dns.Msg).SetQuestion("example.com.", dns.TypeA)
+	resolver.ServeDNS(w, q)
+
+	require.NotNil(t, written, "response must be written")
+	assert.Equal(t, dns.RcodeServerFailure, written.Rcode, "SERVFAIL must propagate")
+	assert.Len(t, queried, 1, "only first upstream should be queried")
+	assert.Equal(t, upstream1.String(), queried[0])
+	for _, rr := range written.Extra {
+		_, isOPT := rr.(*dns.OPT)
+		assert.False(t, isOPT, "synthetic OPT must not leak to a non-EDNS0 client")
+	}
+}

client/internal/engine.go

@@ -508,7 +508,16 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 
 	e.routeManager.SetRouteChangeListener(e.mobileDep.NetworkChangeListener)
 
-	e.dnsServer.SetRouteSources(e.routeManager.GetSelectedClientRoutes, e.routeManager.GetActiveClientRoutes)
+	e.dnsServer.SetRouteChecker(func(ip netip.Addr) bool {
+		for _, routes := range e.routeManager.GetSelectedClientRoutes() {
+			for _, r := range routes {
+				if r.Network.Contains(ip) {
+					return true
+				}
+			}
+		}
+		return false
+	})
 
 	if err = e.wgInterfaceCreate(); err != nil {
 		log.Errorf("failed creating tunnel interface %s: [%s]", e.config.WgIfaceName, err.Error())
@@ -1336,6 +1345,9 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 
 	e.networkSerial = serial
 
+	// Test received (upstream) servers for availability right away instead of upon usage.
+	// If no server of a server group responds this will disable the respective handler and retry later.
+	go e.dnsServer.ProbeAvailability()
 	return nil
 }
 
@@ -1829,7 +1841,7 @@ func (e *Engine) newDnsServer(dnsConfig *nbdns.Config) (dns.Server, error) {
 		return dnsServer, nil
 
 	case "ios":
-		dnsServer := dns.NewDefaultServerIos(e.ctx, e.wgInterface, e.mobileDep.DnsManager, e.statusRecorder, e.config.DisableDNS)
+		dnsServer := dns.NewDefaultServerIos(e.ctx, e.wgInterface, e.mobileDep.DnsManager, e.mobileDep.HostDNSAddresses, e.statusRecorder, e.config.DisableDNS)
 		return dnsServer, nil
 
 	default:

client/internal/routemanager/manager.go

@@ -53,7 +53,6 @@ type Manager interface {
 	GetRouteSelector() *routeselector.RouteSelector
 	GetClientRoutes() route.HAMap
 	GetSelectedClientRoutes() route.HAMap
-	GetActiveClientRoutes() route.HAMap
 	GetClientRoutesWithNetID() map[route.NetID][]*route.Route
 	SetRouteChangeListener(listener listener.NetworkChangeListener)
 	InitialRouteRange() []string
@@ -478,39 +477,6 @@ func (m *DefaultManager) GetSelectedClientRoutes() route.HAMap {
 	return m.routeSelector.FilterSelectedExitNodes(maps.Clone(m.clientRoutes))
 }
 
-// GetActiveClientRoutes returns the subset of selected client routes
-// that are currently reachable: the route's peer is Connected and is
-// the one actively carrying the route (not just an HA sibling).
-func (m *DefaultManager) GetActiveClientRoutes() route.HAMap {
-	m.mux.Lock()
-	selected := m.routeSelector.FilterSelectedExitNodes(maps.Clone(m.clientRoutes))
-	recorder := m.statusRecorder
-	m.mux.Unlock()
-
-	if recorder == nil {
-		return selected
-	}
-
-	out := make(route.HAMap, len(selected))
-	for id, routes := range selected {
-		for _, r := range routes {
-			st, err := recorder.GetPeer(r.Peer)
-			if err != nil {
-				continue
-			}
-			if st.ConnStatus != peer.StatusConnected {
-				continue
-			}
-			if _, hasRoute := st.GetRoutes()[r.Network.String()]; !hasRoute {
-				continue
-			}
-			out[id] = routes
-			break
-		}
-	}
-	return out
-}
-
 // GetClientRoutesWithNetID returns the current routes from the route map, but the keys consist of the network ID only
 func (m *DefaultManager) GetClientRoutesWithNetID() map[route.NetID][]*route.Route {
 	m.mux.Lock()

client/internal/routemanager/mock.go

@@ -19,7 +19,6 @@ type MockManager struct {
 	GetRouteSelectorFunc         func() *routeselector.RouteSelector
 	GetClientRoutesFunc          func() route.HAMap
 	GetSelectedClientRoutesFunc  func() route.HAMap
-	GetActiveClientRoutesFunc    func() route.HAMap
 	GetClientRoutesWithNetIDFunc func() map[route.NetID][]*route.Route
 	StopFunc                     func(manager *statemanager.Manager)
 }
@@ -79,14 +78,6 @@ func (m *MockManager) GetSelectedClientRoutes() route.HAMap {
 	return nil
 }
 
-// GetActiveClientRoutes mock implementation of GetActiveClientRoutes from the Manager interface
-func (m *MockManager) GetActiveClientRoutes() route.HAMap {
-	if m.GetActiveClientRoutesFunc != nil {
-		return m.GetActiveClientRoutesFunc()
-	}
-	return nil
-}
-
 // GetClientRoutesWithNetID mock implementation of GetClientRoutesWithNetID from Manager interface
 func (m *MockManager) GetClientRoutesWithNetID() map[route.NetID][]*route.Route {
 	if m.GetClientRoutesWithNetIDFunc != nil {

client/ios/NetBirdSDK/client.go

@@ -161,7 +161,11 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	cfg.WgIface = interfaceName
 
 	c.connectClient = internal.NewConnectClient(ctx, cfg, c.recorder)
-	return c.connectClient.RunOniOS(fd, c.networkChangeListener, c.dnsManager, c.stateFile)
+	hostDNS := []netip.AddrPort{
+		netip.MustParseAddrPort("9.9.9.9:53"),
+		netip.MustParseAddrPort("149.112.112.112:53"),
+	}
+	return c.connectClient.RunOniOS(fd, c.networkChangeListener, c.dnsManager, hostDNS, c.stateFile)
 }
 
 // Stop the internal client and free the resources

go.mod

@@ -72,7 +72,7 @@ require (
 	github.com/lrh3321/ipset-go v0.0.0-20250619021614-54a0a98ace81
 	github.com/mdlayher/socket v0.5.1
 	github.com/mdp/qrterminal/v3 v3.2.1
-	github.com/miekg/dns v1.1.59
+	github.com/miekg/dns v1.1.72
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/netbirdio/management-integrations/integrations v0.0.0-20260416123949-2355d972be42
 	github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45

go.sum

@@ -421,8 +421,8 @@ github.com/mdp/qrterminal/v3 v3.2.1 h1:6+yQjiiOsSuXT5n9/m60E54vdgFsw0zhADHhHLrFe
 github.com/mdp/qrterminal/v3 v3.2.1/go.mod h1:jOTmXvnBsMy5xqLniO0R++Jmjs2sTm9dFSuQ5kpz/SU=
 github.com/mholt/acmez/v2 v2.0.1 h1:3/3N0u1pLjMK4sNEAFSI+bcvzbPhRpY383sy1kLHJ6k=
 github.com/mholt/acmez/v2 v2.0.1/go.mod h1:fX4c9r5jYwMyMsC+7tkYRxHibkOTgta5DIFGoe67e1U=
-github.com/miekg/dns v1.1.59 h1:C9EXc/UToRwKLhK5wKU/I4QVsBUc8kE6MkHBkeypWZs=
-github.com/miekg/dns v1.1.59/go.mod h1:nZpewl5p6IvctfgrckopVx2OlSEHPRO/U4SYkRklrEk=
+github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
+github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
 github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
 github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=

idp/dex/connector.go

@@ -89,33 +89,21 @@ func (p *Provider) ListConnectors(ctx context.Context) ([]*ConnectorConfig, erro
 }
 
 // UpdateConnector updates an existing connector in Dex storage.
-// It overlays user-mutable config fields (issuer, clientID, clientSecret,
-// redirectURI) onto the stored connector config, and updates the connector name
-// when cfg.Name is set. Empty fields on cfg leave stored values unchanged, so
-// partial updates preserve create-time defaults such as scopes, claimMapping,
-// and userIDKey.
+// It merges incoming updates with existing values to prevent data loss on partial updates.
 func (p *Provider) UpdateConnector(ctx context.Context, cfg *ConnectorConfig) error {
 	if err := p.storage.UpdateConnector(ctx, cfg.ID, func(old storage.Connector) (storage.Connector, error) {
-		if cfg.Type != "" && cfg.Type != inferIdentityProviderType(old.Type, cfg.ID, nil) {
-			return storage.Connector{}, errors.New("connector type change not allowed")
-		}
-
-		configData, err := overlayConnectorConfig(old.Config, cfg)
+		oldCfg, err := p.parseStorageConnector(old)
 		if err != nil {
-			return storage.Connector{}, fmt.Errorf("failed to overlay connector config: %w", err)
+			return storage.Connector{}, fmt.Errorf("failed to parse existing connector: %w", err)
 		}
 
-		name := cfg.Name
-		if name == "" {
-			name = old.Name
-		}
+		mergeConnectorConfig(cfg, oldCfg)
 
-		return storage.Connector{
-			ID:     cfg.ID,
-			Type:   old.Type,
-			Name:   name,
-			Config: configData,
-		}, nil
+		storageConn, err := p.buildStorageConnector(cfg)
+		if err != nil {
+			return storage.Connector{}, fmt.Errorf("failed to build connector: %w", err)
+		}
+		return storageConn, nil
 	}); err != nil {
 		return fmt.Errorf("failed to update connector: %w", err)
 	}
@@ -124,27 +112,23 @@ func (p *Provider) UpdateConnector(ctx context.Context, cfg *ConnectorConfig) er
 	return nil
 }
 
-// overlayConnectorConfig writes only the user-mutable fields onto the existing
-// stored config, preserving every other field (scopes, claimMapping, userIDKey,
-// insecure flags, etc.). Empty fields on cfg leave the existing value alone.
-func overlayConnectorConfig(oldConfig []byte, cfg *ConnectorConfig) ([]byte, error) {
-	var m map[string]any
-	if err := decodeConnectorConfig(oldConfig, &m); err != nil {
-		return nil, err
+// mergeConnectorConfig preserves existing values for empty fields in the update.
+func mergeConnectorConfig(cfg, oldCfg *ConnectorConfig) {
+	if cfg.ClientSecret == "" {
+		cfg.ClientSecret = oldCfg.ClientSecret
 	}
-	if cfg.Issuer != "" {
-		m["issuer"] = cfg.Issuer
+	if cfg.RedirectURI == "" {
+		cfg.RedirectURI = oldCfg.RedirectURI
 	}
-	if cfg.ClientID != "" {
-		m["clientID"] = cfg.ClientID
+	if cfg.Issuer == "" && cfg.Type == oldCfg.Type {
+		cfg.Issuer = oldCfg.Issuer
 	}
-	if cfg.ClientSecret != "" {
-		m["clientSecret"] = cfg.ClientSecret
+	if cfg.ClientID == "" {
+		cfg.ClientID = oldCfg.ClientID
 	}
-	if cfg.RedirectURI != "" {
-		m["redirectURI"] = cfg.RedirectURI
+	if cfg.Name == "" {
+		cfg.Name = oldCfg.Name
 	}
-	return encodeConnectorConfig(m)
 }
 
 // DeleteConnector removes a connector from Dex storage.
@@ -232,10 +216,6 @@ func buildOIDCConnectorConfig(cfg *ConnectorConfig, redirectURI string) ([]byte,
 		oidcConfig["getUserInfo"] = true
 	case "entra":
 		oidcConfig["claimMapping"] = map[string]string{"email": "preferred_username"}
-		// Use the Entra Object ID (oid) instead of the default OIDC sub claim.
-		// Entra issues sub as a per-app pairwise identifier that does not match
-		// the stable Object ID.
-		oidcConfig["userIDKey"] = "oid"
 	case "okta":
 		oidcConfig["scopes"] = []string{"openid", "profile", "email", "groups"}
 	case "pocketid":

idp/dex/connector_test.go

@@ -1,205 +0,0 @@
-package dex
-
-import (
-	"context"
-	"encoding/json"
-	"log/slog"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/dexidp/dex/storage"
-	"github.com/dexidp/dex/storage/sql"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func newTestProvider(t *testing.T) (*Provider, func()) {
-	t.Helper()
-	tmpDir, err := os.MkdirTemp("", "dex-connector-test-*")
-	require.NoError(t, err)
-
-	logger := slog.New(slog.NewTextHandler(os.Stderr, nil))
-	s, err := (&sql.SQLite3{File: filepath.Join(tmpDir, "dex.db")}).Open(logger)
-	require.NoError(t, err)
-
-	return &Provider{storage: s, logger: logger}, func() {
-		_ = s.Close()
-		_ = os.RemoveAll(tmpDir)
-	}
-}
-
-func TestBuildOIDCConnectorConfig_EntraSetsUserIDKey(t *testing.T) {
-	cfg := &ConnectorConfig{
-		ID:           "entra-test",
-		Name:         "Entra",
-		Type:         "entra",
-		Issuer:       "https://login.microsoftonline.com/tid/v2.0",
-		ClientID:     "client-id",
-		ClientSecret: "client-secret",
-	}
-	data, err := buildOIDCConnectorConfig(cfg, "https://example.com/oauth2/callback")
-	require.NoError(t, err)
-
-	var m map[string]any
-	require.NoError(t, json.Unmarshal(data, &m))
-
-	assert.Equal(t, "oid", m["userIDKey"], "entra connectors must default userIDKey to oid")
-	assert.Equal(t, map[string]any{"email": "preferred_username"}, m["claimMapping"])
-}
-
-func TestBuildOIDCConnectorConfig_NonEntraDoesNotSetUserIDKey(t *testing.T) {
-	// ensures the Entra userIDKey override does not leak into other OIDC providers,
-	// which already use a stable sub claim.
-	for _, typ := range []string{"oidc", "zitadel", "okta", "pocketid", "authentik", "keycloak", "adfs"} {
-		t.Run(typ, func(t *testing.T) {
-			data, err := buildOIDCConnectorConfig(&ConnectorConfig{Type: typ}, "https://example.com/oauth2/callback")
-			require.NoError(t, err)
-			var m map[string]any
-			require.NoError(t, json.Unmarshal(data, &m))
-			_, ok := m["userIDKey"]
-			assert.False(t, ok, "%s connectors must not have userIDKey set", typ)
-		})
-	}
-}
-
-func TestUpdateConnector_PreservesCreateTimeDefaults(t *testing.T) {
-	ctx := context.Background()
-	p, cleanup := newTestProvider(t)
-	defer cleanup()
-
-	created, err := p.CreateConnector(ctx, &ConnectorConfig{
-		ID:           "entra-test",
-		Name:         "Entra",
-		Type:         "entra",
-		Issuer:       "https://login.microsoftonline.com/tid/v2.0",
-		ClientID:     "client-id",
-		ClientSecret: "old-secret",
-		RedirectURI:  "https://example.com/oauth2/callback",
-	})
-	require.NoError(t, err)
-	require.Equal(t, "entra-test", created.ID)
-
-	// Rotate only the client secret.
-	err = p.UpdateConnector(ctx, &ConnectorConfig{
-		ID:           "entra-test",
-		Type:         "entra",
-		ClientSecret: "new-secret",
-	})
-	require.NoError(t, err)
-
-	conn, err := p.storage.GetConnector(ctx, "entra-test")
-	require.NoError(t, err)
-	var m map[string]any
-	require.NoError(t, json.Unmarshal(conn.Config, &m))
-
-	assert.Equal(t, "new-secret", m["clientSecret"], "clientSecret should be rotated")
-	assert.Equal(t, "client-id", m["clientID"], "clientID must survive (overlay should leave it alone)")
-	assert.Equal(t, "https://login.microsoftonline.com/tid/v2.0", m["issuer"])
-	assert.Equal(t, "oid", m["userIDKey"], "userIDKey must survive update")
-	assert.Equal(t, map[string]any{"email": "preferred_username"}, m["claimMapping"], "claimMapping must survive update")
-}
-
-func TestUpdateConnector_DoesNotAddUserIDKeyToExistingConnector(t *testing.T) {
-	ctx := context.Background()
-	p, cleanup := newTestProvider(t)
-	defer cleanup()
-
-	// Seed a connector directly into storage without userIDKey
-	preFixConfig, err := json.Marshal(map[string]any{
-		"issuer":       "https://login.microsoftonline.com/tid/v2.0",
-		"clientID":     "client-id",
-		"clientSecret": "old-secret",
-		"redirectURI":  "https://example.com/oauth2/callback",
-		"scopes":       []string{"openid", "profile", "email"},
-		"claimMapping": map[string]string{"email": "preferred_username"},
-	})
-	require.NoError(t, err)
-
-	require.NoError(t, p.storage.CreateConnector(ctx, storage.Connector{
-		ID:     "entra-prefix",
-		Type:   "oidc",
-		Name:   "Entra",
-		Config: preFixConfig,
-	}))
-
-	// Rotate client secret via UpdateConnector.
-	err = p.UpdateConnector(ctx, &ConnectorConfig{
-		ID:           "entra-prefix",
-		Type:         "entra",
-		ClientSecret: "new-secret",
-	})
-	require.NoError(t, err)
-
-	conn, err := p.storage.GetConnector(ctx, "entra-prefix")
-	require.NoError(t, err)
-	var m map[string]any
-	require.NoError(t, json.Unmarshal(conn.Config, &m))
-
-	assert.Equal(t, "new-secret", m["clientSecret"])
-	_, has := m["userIDKey"]
-	assert.False(t, has, "userIDKey must not be auto-added to a connector that did not have it before")
-}
-
-func TestUpdateConnector_RejectsTypeChange(t *testing.T) {
-	ctx := context.Background()
-	p, cleanup := newTestProvider(t)
-	defer cleanup()
-
-	_, err := p.CreateConnector(ctx, &ConnectorConfig{
-		ID:           "entra-test",
-		Name:         "Entra",
-		Type:         "entra",
-		Issuer:       "https://login.microsoftonline.com/tid/v2.0",
-		ClientID:     "client-id",
-		ClientSecret: "secret",
-		RedirectURI:  "https://example.com/oauth2/callback",
-	})
-	require.NoError(t, err)
-
-	// Attempt to switch the connector to okta.
-	err = p.UpdateConnector(ctx, &ConnectorConfig{
-		ID:   "entra-test",
-		Type: "okta",
-	})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "connector type change not allowed")
-
-	// stored connector type/config unchanged after the rejected update.
-	conn, err := p.storage.GetConnector(ctx, "entra-test")
-	require.NoError(t, err)
-	assert.Equal(t, "oidc", conn.Type)
-	var m map[string]any
-	require.NoError(t, json.Unmarshal(conn.Config, &m))
-	assert.Equal(t, "oid", m["userIDKey"])
-}
-
-func TestUpdateConnector_AllowsSameTypeUpdate(t *testing.T) {
-	ctx := context.Background()
-	p, cleanup := newTestProvider(t)
-	defer cleanup()
-
-	_, err := p.CreateConnector(ctx, &ConnectorConfig{
-		ID:           "entra-test",
-		Name:         "Entra",
-		Type:         "entra",
-		Issuer:       "https://login.microsoftonline.com/old/v2.0",
-		ClientID:     "client-id",
-		ClientSecret: "secret",
-		RedirectURI:  "https://example.com/oauth2/callback",
-	})
-	require.NoError(t, err)
-
-	err = p.UpdateConnector(ctx, &ConnectorConfig{
-		ID:     "entra-test",
-		Type:   "entra",
-		Issuer: "https://login.microsoftonline.com/new/v2.0",
-	})
-	require.NoError(t, err)
-
-	conn, err := p.storage.GetConnector(ctx, "entra-test")
-	require.NoError(t, err)
-	var m map[string]any
-	require.NoError(t, json.Unmarshal(conn.Config, &m))
-	assert.Equal(t, "https://login.microsoftonline.com/new/v2.0", m["issuer"])
-}

management/internals/shared/grpc/proxy.go

@@ -11,8 +11,6 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
-	"os"
-	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -84,40 +82,11 @@ type ProxyServiceServer struct {
 	// Store for PKCE verifiers
 	pkceVerifierStore *PKCEVerifierStore
 
-	// tokenTTL is the lifetime of one-time tokens generated for proxy
-	// authentication. Defaults to defaultProxyTokenTTL when zero.
-	tokenTTL time.Duration
-
-	// snapshotBatchSize is the number of mappings per gRPC message during
-	// initial snapshot delivery. Configurable via NB_PROXY_SNAPSHOT_BATCH_SIZE.
-	snapshotBatchSize int
-
 	cancel context.CancelFunc
 }
 
 const pkceVerifierTTL = 10 * time.Minute
 
-const defaultProxyTokenTTL = 5 * time.Minute
-
-const defaultSnapshotBatchSize = 500
-
-func snapshotBatchSizeFromEnv() int {
-	if v := os.Getenv("NB_PROXY_SNAPSHOT_BATCH_SIZE"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			return n
-		}
-	}
-	return defaultSnapshotBatchSize
-}
-
-// proxyTokenTTL returns the configured token TTL or the default when unset.
-func (s *ProxyServiceServer) proxyTokenTTL() time.Duration {
-	if s.tokenTTL > 0 {
-		return s.tokenTTL
-	}
-	return defaultProxyTokenTTL
-}
-
 // proxyConnection represents a connected proxy
 type proxyConnection struct {
 	proxyID      string
@@ -141,7 +110,6 @@ func NewProxyServiceServer(accessLogMgr accesslogs.Manager, tokenStore *OneTimeT
 		peersManager:      peersManager,
 		usersManager:      usersManager,
 		proxyManager:      proxyMgr,
-		snapshotBatchSize: snapshotBatchSizeFromEnv(),
 		cancel:            cancel,
 	}
 	go s.cleanupStaleProxies(ctx)
@@ -224,6 +192,11 @@ func (s *ProxyServiceServer) GetMappingUpdate(req *proto.GetMappingUpdateRequest
 		cancel:       cancel,
 	}
 
+	s.connectedProxies.Store(proxyID, conn)
+	if err := s.proxyController.RegisterProxyToCluster(ctx, conn.address, proxyID); err != nil {
+		log.WithContext(ctx).Warnf("Failed to register proxy %s in cluster: %v", proxyID, err)
+	}
+
 	// Register proxy in database with capabilities
 	var caps *proxy.Capabilities
 	if c := req.GetCapabilities(); c != nil {
@@ -236,31 +209,13 @@ func (s *ProxyServiceServer) GetMappingUpdate(req *proto.GetMappingUpdateRequest
 	proxyRecord, err := s.proxyManager.Connect(ctx, proxyID, sessionID, proxyAddress, peerInfo, caps)
 	if err != nil {
 		log.WithContext(ctx).Warnf("failed to register proxy %s in database: %v", proxyID, err)
-		cancel()
+		s.connectedProxies.CompareAndDelete(proxyID, conn)
+		if unregErr := s.proxyController.UnregisterProxyFromCluster(ctx, conn.address, proxyID); unregErr != nil {
+			log.WithContext(ctx).Debugf("cleanup after Connect failure for proxy %s: %v", proxyID, unregErr)
+		}
 		return status.Errorf(codes.Internal, "register proxy in database: %v", err)
 	}
 
-	s.connectedProxies.Store(proxyID, conn)
-	if err := s.proxyController.RegisterProxyToCluster(ctx, conn.address, proxyID); err != nil {
-		log.WithContext(ctx).Warnf("Failed to register proxy %s in cluster: %v", proxyID, err)
-	}
-
-	if err := s.sendSnapshot(ctx, conn); err != nil {
-		if s.connectedProxies.CompareAndDelete(proxyID, conn) {
-			if unregErr := s.proxyController.UnregisterProxyFromCluster(context.Background(), conn.address, proxyID); unregErr != nil {
-				log.WithContext(ctx).Debugf("cleanup after snapshot failure for proxy %s: %v", proxyID, unregErr)
-			}
-		}
-		cancel()
-		if disconnErr := s.proxyManager.Disconnect(context.Background(), proxyID, sessionID); disconnErr != nil {
-			log.WithContext(ctx).Debugf("cleanup after snapshot failure for proxy %s: %v", proxyID, disconnErr)
-		}
-		return fmt.Errorf("send snapshot to proxy %s: %w", proxyID, err)
-	}
-
-	errChan := make(chan error, 2)
-	go s.sender(conn, errChan)
-
 	log.WithFields(log.Fields{
 		"proxy_id":      proxyID,
 		"session_id":    sessionID,
@@ -286,6 +241,13 @@ func (s *ProxyServiceServer) GetMappingUpdate(req *proto.GetMappingUpdateRequest
 		log.Infof("Proxy %s session %s disconnected", proxyID, sessionID)
 	}()
 
+	if err := s.sendSnapshot(ctx, conn); err != nil {
+		return fmt.Errorf("send snapshot to proxy %s: %w", proxyID, err)
+	}
+
+	errChan := make(chan error, 2)
+	go s.sender(conn, errChan)
+
 	go s.heartbeat(connCtx, proxyRecord)
 
 	select {
@@ -328,27 +290,22 @@ func (s *ProxyServiceServer) sendSnapshot(ctx context.Context, conn *proxyConnec
 		return err
 	}
 
-	// Send mappings in batches to reduce per-message gRPC overhead while
-	// staying well within the default 4 MB message size limit.
-	for i := 0; i < len(mappings); i += s.snapshotBatchSize {
-		end := i + s.snapshotBatchSize
-		if end > len(mappings) {
-			end = len(mappings)
-		}
-		if err := conn.stream.Send(&proto.GetMappingUpdateResponse{
-			Mapping:             mappings[i:end],
-			InitialSyncComplete: end == len(mappings),
-		}); err != nil {
-			return fmt.Errorf("send snapshot batch: %w", err)
-		}
-	}
-
 	if len(mappings) == 0 {
 		if err := conn.stream.Send(&proto.GetMappingUpdateResponse{
 			InitialSyncComplete: true,
 		}); err != nil {
 			return fmt.Errorf("send snapshot completion: %w", err)
 		}
+		return nil
+	}
+
+	for i, m := range mappings {
+		if err := conn.stream.Send(&proto.GetMappingUpdateResponse{
+			Mapping:             []*proto.ProxyMapping{m},
+			InitialSyncComplete: i == len(mappings)-1,
+		}); err != nil {
+			return fmt.Errorf("send proxy mapping: %w", err)
+		}
 	}
 
 	return nil
@@ -366,9 +323,13 @@ func (s *ProxyServiceServer) snapshotServiceMappings(ctx context.Context, conn *
 			continue
 		}
 
-		token, err := s.tokenStore.GenerateToken(service.AccountID, service.ID, s.proxyTokenTTL())
+		token, err := s.tokenStore.GenerateToken(service.AccountID, service.ID, 5*time.Minute)
 		if err != nil {
-			return nil, fmt.Errorf("generate auth token for service %s: %w", service.ID, err)
+			log.WithFields(log.Fields{
+				"service": service.Name,
+				"account": service.AccountID,
+			}).WithError(err).Error("failed to generate auth token for snapshot")
+			continue
 		}
 
 		m := service.ToProtoMapping(rpservice.Create, token, s.GetOIDCValidationConfig())
@@ -448,16 +409,13 @@ func (s *ProxyServiceServer) SendServiceUpdate(update *proto.GetMappingUpdateRes
 		conn := value.(*proxyConnection)
 		resp := s.perProxyMessage(update, conn.proxyID)
 		if resp == nil {
-			log.Warnf("Token generation failed for proxy %s, disconnecting to force resync", conn.proxyID)
-			conn.cancel()
 			return true
 		}
 		select {
 		case conn.sendChan <- resp:
 			log.Debugf("Sent service update to proxy server %s", conn.proxyID)
 		default:
-			log.Warnf("Send channel full for proxy %s, disconnecting to force resync", conn.proxyID)
-			conn.cancel()
+			log.Warnf("Failed to send service update to proxy server %s (channel full)", conn.proxyID)
 		}
 		return true
 	})
@@ -537,16 +495,13 @@ func (s *ProxyServiceServer) SendServiceUpdateToCluster(ctx context.Context, upd
 		}
 		msg := s.perProxyMessage(updateResponse, proxyID)
 		if msg == nil {
-			log.WithContext(ctx).Warnf("Token generation failed for proxy %s in cluster %s, disconnecting to force resync", proxyID, clusterAddr)
-			conn.cancel()
 			continue
 		}
 		select {
 		case conn.sendChan <- msg:
 			log.WithContext(ctx).Debugf("Sent service update with id %s to proxy %s in cluster %s", update.Id, proxyID, clusterAddr)
 		default:
-			log.WithContext(ctx).Warnf("Send channel full for proxy %s in cluster %s, disconnecting to force resync", proxyID, clusterAddr)
-			conn.cancel()
+			log.WithContext(ctx).Warnf("Failed to send service update to proxy %s in cluster %s (channel full)", proxyID, clusterAddr)
 		}
 	}
 }
@@ -572,8 +527,7 @@ func proxyAcceptsMapping(conn *proxyConnection, mapping *proto.ProxyMapping) boo
 // perProxyMessage returns a copy of update with a fresh one-time token for
 // create/update operations. For delete operations the original mapping is
 // used unchanged because proxies do not need to authenticate for removal.
-// Returns nil if token generation fails; the caller must disconnect the
-// proxy so it can resync via a fresh snapshot on reconnect.
+// Returns nil if token generation fails (the proxy should be skipped).
 func (s *ProxyServiceServer) perProxyMessage(update *proto.GetMappingUpdateResponse, proxyID string) *proto.GetMappingUpdateResponse {
 	resp := make([]*proto.ProxyMapping, 0, len(update.Mapping))
 	for _, mapping := range update.Mapping {
@@ -582,7 +536,7 @@ func (s *ProxyServiceServer) perProxyMessage(update *proto.GetMappingUpdateRespo
 			continue
 		}
 
-		token, err := s.tokenStore.GenerateToken(mapping.AccountId, mapping.Id, s.proxyTokenTTL())
+		token, err := s.tokenStore.GenerateToken(mapping.AccountId, mapping.Id, 5*time.Minute)
 		if err != nil {
 			log.Warnf("Failed to generate token for proxy %s: %v", proxyID, err)
 			return nil

management/internals/shared/grpc/proxy_snapshot_test.go

@@ -1,174 +0,0 @@
-package grpc
-
-import (
-	"context"
-	"fmt"
-	"testing"
-
-	"github.com/golang/mock/gomock"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/metadata"
-
-	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
-	"github.com/netbirdio/netbird/shared/management/proto"
-)
-
-// recordingStream captures all messages sent via Send so tests can inspect
-// batching behaviour without a real gRPC transport.
-type recordingStream struct {
-	grpc.ServerStream
-	messages []*proto.GetMappingUpdateResponse
-}
-
-func (s *recordingStream) Send(m *proto.GetMappingUpdateResponse) error {
-	s.messages = append(s.messages, m)
-	return nil
-}
-
-func (s *recordingStream) Context() context.Context     { return context.Background() }
-func (s *recordingStream) SetHeader(metadata.MD) error  { return nil }
-func (s *recordingStream) SendHeader(metadata.MD) error { return nil }
-func (s *recordingStream) SetTrailer(metadata.MD)       {}
-func (s *recordingStream) SendMsg(any) error            { return nil }
-func (s *recordingStream) RecvMsg(any) error            { return nil }
-
-// makeServices creates n enabled services assigned to the given cluster.
-func makeServices(n int, cluster string) []*rpservice.Service {
-	services := make([]*rpservice.Service, n)
-	for i := range n {
-		services[i] = &rpservice.Service{
-			ID:           fmt.Sprintf("svc-%d", i),
-			AccountID:    "acct-1",
-			Name:         fmt.Sprintf("svc-%d", i),
-			Domain:       fmt.Sprintf("svc-%d.example.com", i),
-			ProxyCluster: cluster,
-			Enabled:      true,
-			Targets: []*rpservice.Target{
-				{TargetType: rpservice.TargetTypeHost, TargetId: "host-1"},
-			},
-		}
-	}
-	return services
-}
-
-func newSnapshotTestServer(t *testing.T, batchSize int) *ProxyServiceServer {
-	t.Helper()
-	s := &ProxyServiceServer{
-		tokenStore:        NewOneTimeTokenStore(context.Background(), testCacheStore(t)),
-		snapshotBatchSize: batchSize,
-	}
-	s.SetProxyController(newTestProxyController())
-	return s
-}
-
-func TestSendSnapshot_BatchesMappings(t *testing.T) {
-	const cluster = "cluster.example.com"
-	const batchSize = 3
-	const totalServices = 7 // 3 + 3 + 1
-
-	ctrl := gomock.NewController(t)
-	mgr := rpservice.NewMockManager(ctrl)
-	mgr.EXPECT().GetGlobalServices(gomock.Any()).Return(makeServices(totalServices, cluster), nil)
-
-	s := newSnapshotTestServer(t, batchSize)
-	s.serviceManager = mgr
-
-	stream := &recordingStream{}
-	conn := &proxyConnection{
-		proxyID: "proxy-a",
-		address: cluster,
-		stream:  stream,
-	}
-
-	err := s.sendSnapshot(context.Background(), conn)
-	require.NoError(t, err)
-
-	// Expect ceil(7/3) = 3 messages
-	require.Len(t, stream.messages, 3, "should send ceil(totalServices/batchSize) messages")
-
-	assert.Len(t, stream.messages[0].Mapping, 3)
-	assert.False(t, stream.messages[0].InitialSyncComplete, "first batch should not be sync-complete")
-
-	assert.Len(t, stream.messages[1].Mapping, 3)
-	assert.False(t, stream.messages[1].InitialSyncComplete, "middle batch should not be sync-complete")
-
-	assert.Len(t, stream.messages[2].Mapping, 1)
-	assert.True(t, stream.messages[2].InitialSyncComplete, "last batch must be sync-complete")
-
-	// Verify all service IDs are present exactly once
-	seen := make(map[string]bool)
-	for _, msg := range stream.messages {
-		for _, m := range msg.Mapping {
-			assert.False(t, seen[m.Id], "duplicate service ID %s", m.Id)
-			seen[m.Id] = true
-		}
-	}
-	assert.Len(t, seen, totalServices)
-}
-
-func TestSendSnapshot_ExactBatchMultiple(t *testing.T) {
-	const cluster = "cluster.example.com"
-	const batchSize = 3
-	const totalServices = 6 // exactly 2 batches
-
-	ctrl := gomock.NewController(t)
-	mgr := rpservice.NewMockManager(ctrl)
-	mgr.EXPECT().GetGlobalServices(gomock.Any()).Return(makeServices(totalServices, cluster), nil)
-
-	s := newSnapshotTestServer(t, batchSize)
-	s.serviceManager = mgr
-
-	stream := &recordingStream{}
-	conn := &proxyConnection{proxyID: "proxy-a", address: cluster, stream: stream}
-
-	require.NoError(t, s.sendSnapshot(context.Background(), conn))
-	require.Len(t, stream.messages, 2)
-
-	assert.Len(t, stream.messages[0].Mapping, 3)
-	assert.False(t, stream.messages[0].InitialSyncComplete)
-
-	assert.Len(t, stream.messages[1].Mapping, 3)
-	assert.True(t, stream.messages[1].InitialSyncComplete)
-}
-
-func TestSendSnapshot_SingleBatch(t *testing.T) {
-	const cluster = "cluster.example.com"
-	const batchSize = 100
-	const totalServices = 5
-
-	ctrl := gomock.NewController(t)
-	mgr := rpservice.NewMockManager(ctrl)
-	mgr.EXPECT().GetGlobalServices(gomock.Any()).Return(makeServices(totalServices, cluster), nil)
-
-	s := newSnapshotTestServer(t, batchSize)
-	s.serviceManager = mgr
-
-	stream := &recordingStream{}
-	conn := &proxyConnection{proxyID: "proxy-a", address: cluster, stream: stream}
-
-	require.NoError(t, s.sendSnapshot(context.Background(), conn))
-	require.Len(t, stream.messages, 1, "all mappings should fit in one batch")
-	assert.Len(t, stream.messages[0].Mapping, totalServices)
-	assert.True(t, stream.messages[0].InitialSyncComplete)
-}
-
-func TestSendSnapshot_EmptySnapshot(t *testing.T) {
-	const cluster = "cluster.example.com"
-
-	ctrl := gomock.NewController(t)
-	mgr := rpservice.NewMockManager(ctrl)
-	mgr.EXPECT().GetGlobalServices(gomock.Any()).Return(nil, nil)
-
-	s := newSnapshotTestServer(t, 500)
-	s.serviceManager = mgr
-
-	stream := &recordingStream{}
-	conn := &proxyConnection{proxyID: "proxy-a", address: cluster, stream: stream}
-
-	require.NoError(t, s.sendSnapshot(context.Background(), conn))
-	require.Len(t, stream.messages, 1, "empty snapshot must still send sync-complete")
-	assert.Empty(t, stream.messages[0].Mapping)
-	assert.True(t, stream.messages[0].InitialSyncComplete)
-}

management/internals/shared/grpc/proxy_test.go

@@ -85,14 +85,11 @@ func registerFakeProxy(s *ProxyServiceServer, proxyID, clusterAddr string) chan
 // registerFakeProxyWithCaps adds a fake proxy connection with explicit capabilities.
 func registerFakeProxyWithCaps(s *ProxyServiceServer, proxyID, clusterAddr string, caps *proto.ProxyCapabilities) chan *proto.GetMappingUpdateResponse {
 	ch := make(chan *proto.GetMappingUpdateResponse, 10)
-	ctx, cancel := context.WithCancel(context.Background())
 	conn := &proxyConnection{
 		proxyID:      proxyID,
 		address:      clusterAddr,
 		capabilities: caps,
 		sendChan:     ch,
-		ctx:          ctx,
-		cancel:       cancel,
 	}
 	s.connectedProxies.Store(proxyID, conn)
 

management/server/types/user_invite_test.go

@@ -144,11 +144,8 @@ func TestValidateInviteToken_ModifiedToken(t *testing.T) {
 	_, plainToken, err := GenerateInviteToken()
 	require.NoError(t, err)
 
-	replacement := "X"
-	if plainToken[5] == 'X' {
-		replacement = "Y"
-	}
-	modifiedToken := plainToken[:5] + replacement + plainToken[6:]
+	// Modify one character in the secret part
+	modifiedToken := plainToken[:5] + "X" + plainToken[6:]
 	err = ValidateInviteToken(modifiedToken)
 	require.Error(t, err)
 }

proxy/management_integration_test.go

@@ -364,16 +364,14 @@ func TestIntegration_ProxyConnection_HappyPath(t *testing.T) {
 	})
 	require.NoError(t, err)
 
+	// Receive all mappings from the snapshot - server sends each mapping individually
 	mappingsByID := make(map[string]*proto.ProxyMapping)
-	for {
+	for i := 0; i < 2; i++ {
 		msg, err := stream.Recv()
 		require.NoError(t, err)
 		for _, m := range msg.GetMapping() {
 			mappingsByID[m.GetId()] = m
 		}
-		if msg.GetInitialSyncComplete() {
-			break
-		}
 	}
 
 	// Should receive 2 mappings total
@@ -413,14 +411,12 @@ func TestIntegration_ProxyConnection_SendsClusterAddress(t *testing.T) {
 	})
 	require.NoError(t, err)
 
+	// Receive all mappings - server sends each mapping individually
 	mappings := make([]*proto.ProxyMapping, 0)
-	for {
+	for i := 0; i < 2; i++ {
 		msg, err := stream.Recv()
 		require.NoError(t, err)
 		mappings = append(mappings, msg.GetMapping()...)
-		if msg.GetInitialSyncComplete() {
-			break
-		}
 	}
 
 	// Should receive the 2 mappings matching the cluster
@@ -444,15 +440,13 @@ func TestIntegration_ProxyConnection_Reconnect_ReceivesSameConfig(t *testing.T)
 	clusterAddress := "test.proxy.io"
 	proxyID := "test-proxy-reconnect"
 
-	receiveMappings := func(stream proto.ProxyService_GetMappingUpdateClient) []*proto.ProxyMapping {
+	// Helper to receive all mappings from a stream
+	receiveMappings := func(stream proto.ProxyService_GetMappingUpdateClient, count int) []*proto.ProxyMapping {
 		var mappings []*proto.ProxyMapping
-		for {
+		for i := 0; i < count; i++ {
 			msg, err := stream.Recv()
 			require.NoError(t, err)
 			mappings = append(mappings, msg.GetMapping()...)
-			if msg.GetInitialSyncComplete() {
-				break
-			}
 		}
 		return mappings
 	}
@@ -466,7 +460,7 @@ func TestIntegration_ProxyConnection_Reconnect_ReceivesSameConfig(t *testing.T)
 	})
 	require.NoError(t, err)
 
-	firstMappings := receiveMappings(stream1)
+	firstMappings := receiveMappings(stream1, 2)
 	cancel1()
 
 	time.Sleep(100 * time.Millisecond)
@@ -482,7 +476,7 @@ func TestIntegration_ProxyConnection_Reconnect_ReceivesSameConfig(t *testing.T)
 	})
 	require.NoError(t, err)
 
-	secondMappings := receiveMappings(stream2)
+	secondMappings := receiveMappings(stream2, 2)
 
 	// Should receive the same mappings
 	assert.Equal(t, len(firstMappings), len(secondMappings),
@@ -548,14 +542,12 @@ func TestIntegration_ProxyConnection_ReconnectDoesNotDuplicateState(t *testing.T
 		}
 	}
 
+	// Helper to receive and apply all mappings
 	receiveAndApply := func(stream proto.ProxyService_GetMappingUpdateClient) {
-		for {
+		for i := 0; i < 2; i++ {
 			msg, err := stream.Recv()
 			require.NoError(t, err)
 			applyMappings(msg.GetMapping())
-			if msg.GetInitialSyncComplete() {
-				break
-			}
 		}
 	}
 
@@ -644,14 +636,12 @@ func TestIntegration_ProxyConnection_MultipleProxiesReceiveUpdates(t *testing.T)
 			})
 			require.NoError(t, err)
 
+			// Receive all mappings - server sends each mapping individually
 			count := 0
-			for {
+			for i := 0; i < 2; i++ {
 				msg, err := stream.Recv()
 				require.NoError(t, err)
 				count += len(msg.GetMapping())
-				if msg.GetInitialSyncComplete() {
-					break
-				}
 			}
 
 			mu.Lock()
@@ -691,12 +681,9 @@ func TestIntegration_ProxyConnection_FastReconnectDoesNotLoseState(t *testing.T)
 	})
 	require.NoError(t, err)
 
-	for {
-		msg, err := stream1.Recv()
+	for i := 0; i < 2; i++ {
+		_, err := stream1.Recv()
 		require.NoError(t, err)
-		if msg.GetInitialSyncComplete() {
-			break
-		}
 	}
 
 	require.Contains(t, setup.proxyService.GetConnectedProxies(), proxyID,
@@ -712,12 +699,9 @@ func TestIntegration_ProxyConnection_FastReconnectDoesNotLoseState(t *testing.T)
 	})
 	require.NoError(t, err)
 
-	for {
-		msg, err := stream2.Recv()
+	for i := 0; i < 2; i++ {
+		_, err := stream2.Recv()
 		require.NoError(t, err)
-		if msg.GetInitialSyncComplete() {
-			break
-		}
 	}
 
 	cancel1()

proxy/server.go

@@ -943,8 +943,6 @@ func (s *Server) newManagementMappingWorker(ctx context.Context, client proto.Pr
 	operation := func() error {
 		s.Logger.Debug("connecting to management mapping stream")
 
-		initialSyncDone = false
-
 		if s.healthChecker != nil {
 			s.healthChecker.SetManagementConnected(false)
 		}
@@ -1002,11 +1000,6 @@ func (s *Server) handleMappingStream(ctx context.Context, mappingClient proto.Pr
 		return ctx.Err()
 	}
 
-	var snapshotIDs map[types.ServiceID]struct{}
-	if !*initialSyncDone {
-		snapshotIDs = make(map[types.ServiceID]struct{})
-	}
-
 	for {
 		// Check for context completion to gracefully shutdown.
 		select {
@@ -1027,45 +1020,17 @@ func (s *Server) handleMappingStream(ctx context.Context, mappingClient proto.Pr
 			s.processMappings(ctx, msg.GetMapping())
 			s.Logger.Debug("Processing mapping update completed")
 
-			if !*initialSyncDone {
-				for _, m := range msg.GetMapping() {
-					snapshotIDs[types.ServiceID(m.GetId())] = struct{}{}
-				}
-				if msg.GetInitialSyncComplete() {
-					s.reconcileSnapshot(ctx, snapshotIDs)
-					snapshotIDs = nil
-					if s.healthChecker != nil {
-						s.healthChecker.SetInitialSyncComplete()
-					}
-					*initialSyncDone = true
-					s.Logger.Info("Initial mapping sync complete")
+			if !*initialSyncDone && msg.GetInitialSyncComplete() {
+				if s.healthChecker != nil {
+					s.healthChecker.SetInitialSyncComplete()
 				}
+				*initialSyncDone = true
+				s.Logger.Info("Initial mapping sync complete")
 			}
 		}
 	}
 }
 
-// reconcileSnapshot removes local mappings that are absent from the snapshot.
-// This ensures services deleted while the proxy was disconnected get cleaned up.
-func (s *Server) reconcileSnapshot(ctx context.Context, snapshotIDs map[types.ServiceID]struct{}) {
-	s.portMu.RLock()
-	var stale []*proto.ProxyMapping
-	for svcID, mapping := range s.lastMappings {
-		if _, ok := snapshotIDs[svcID]; !ok {
-			stale = append(stale, mapping)
-		}
-	}
-	s.portMu.RUnlock()
-
-	for _, mapping := range stale {
-		s.Logger.WithFields(log.Fields{
-			"service_id": mapping.GetId(),
-			"domain":     mapping.GetDomain(),
-		}).Info("Removing stale mapping absent from snapshot")
-		s.removeMapping(ctx, mapping)
-	}
-}
-
 func (s *Server) processMappings(ctx context.Context, mappings []*proto.ProxyMapping) {
 	for _, mapping := range mappings {
 		s.Logger.WithFields(log.Fields{

proxy/snapshot_reconcile_test.go

@@ -1,227 +0,0 @@
-package proxy
-
-import (
-	"context"
-	"io"
-	"testing"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/proxy/internal/health"
-	"github.com/netbirdio/netbird/proxy/internal/types"
-	"github.com/netbirdio/netbird/shared/management/proto"
-)
-
-// collectStaleIDs mirrors the stale-detection logic in reconcileSnapshot
-// so we can verify it without triggering removeMapping (which requires full
-// server wiring). This keeps the test focused on the detection algorithm.
-func collectStaleIDs(lastMappings map[types.ServiceID]*proto.ProxyMapping, snapshotIDs map[types.ServiceID]struct{}) []types.ServiceID {
-	var stale []types.ServiceID
-	for svcID := range lastMappings {
-		if _, ok := snapshotIDs[svcID]; !ok {
-			stale = append(stale, svcID)
-		}
-	}
-	return stale
-}
-
-// TestStaleDetection_PartialOverlap verifies that only services absent from
-// the snapshot are flagged as stale.
-func TestStaleDetection_PartialOverlap(t *testing.T) {
-	local := map[types.ServiceID]*proto.ProxyMapping{
-		"svc-1":       {Id: "svc-1"},
-		"svc-2":       {Id: "svc-2"},
-		"svc-stale-a": {Id: "svc-stale-a"},
-		"svc-stale-b": {Id: "svc-stale-b"},
-	}
-	snapshot := map[types.ServiceID]struct{}{
-		"svc-1": {},
-		"svc-2": {},
-		"svc-3": {}, // new service, not in local
-	}
-
-	stale := collectStaleIDs(local, snapshot)
-	assert.Len(t, stale, 2)
-	staleSet := make(map[types.ServiceID]struct{})
-	for _, id := range stale {
-		staleSet[id] = struct{}{}
-	}
-	assert.Contains(t, staleSet, types.ServiceID("svc-stale-a"))
-	assert.Contains(t, staleSet, types.ServiceID("svc-stale-b"))
-}
-
-// TestStaleDetection_AllStale verifies an empty snapshot flags everything.
-func TestStaleDetection_AllStale(t *testing.T) {
-	local := map[types.ServiceID]*proto.ProxyMapping{
-		"svc-1": {Id: "svc-1"},
-		"svc-2": {Id: "svc-2"},
-	}
-	stale := collectStaleIDs(local, map[types.ServiceID]struct{}{})
-	assert.Len(t, stale, 2)
-}
-
-// TestStaleDetection_NoneStale verifies full overlap produces no stale entries.
-func TestStaleDetection_NoneStale(t *testing.T) {
-	local := map[types.ServiceID]*proto.ProxyMapping{
-		"svc-1": {Id: "svc-1"},
-		"svc-2": {Id: "svc-2"},
-	}
-	snapshot := map[types.ServiceID]struct{}{
-		"svc-1": {},
-		"svc-2": {},
-	}
-	stale := collectStaleIDs(local, snapshot)
-	assert.Empty(t, stale)
-}
-
-// TestStaleDetection_EmptyLocal verifies no stale entries when local is empty.
-func TestStaleDetection_EmptyLocal(t *testing.T) {
-	stale := collectStaleIDs(
-		map[types.ServiceID]*proto.ProxyMapping{},
-		map[types.ServiceID]struct{}{"svc-1": {}},
-	)
-	assert.Empty(t, stale)
-}
-
-// TestReconcileSnapshot_NoStale verifies reconciliation is a no-op when all
-// local mappings are present in the snapshot (removeMapping is never called).
-func TestReconcileSnapshot_NoStale(t *testing.T) {
-	s := &Server{
-		Logger:       log.StandardLogger(),
-		lastMappings: make(map[types.ServiceID]*proto.ProxyMapping),
-	}
-	s.lastMappings["svc-1"] = &proto.ProxyMapping{Id: "svc-1"}
-	s.lastMappings["svc-2"] = &proto.ProxyMapping{Id: "svc-2"}
-
-	snapshotIDs := map[types.ServiceID]struct{}{
-		"svc-1": {},
-		"svc-2": {},
-	}
-	// This should not panic — no stale entries means removeMapping is never called.
-	s.reconcileSnapshot(context.Background(), snapshotIDs)
-
-	assert.Len(t, s.lastMappings, 2, "no mappings should be removed when all are in snapshot")
-}
-
-// TestReconcileSnapshot_EmptyLocal verifies reconciliation is a no-op with
-// no local mappings.
-func TestReconcileSnapshot_EmptyLocal(t *testing.T) {
-	s := &Server{
-		Logger:       log.StandardLogger(),
-		lastMappings: make(map[types.ServiceID]*proto.ProxyMapping),
-	}
-	s.reconcileSnapshot(context.Background(), map[types.ServiceID]struct{}{"svc-1": {}})
-	assert.Empty(t, s.lastMappings)
-}
-
-// --- handleMappingStream tests for batched snapshot ID accumulation ---
-
-// TestHandleMappingStream_BatchedSnapshotSyncComplete verifies that sync is
-// marked done only after the final InitialSyncComplete message, even when
-// the snapshot arrives in multiple batches.
-func TestHandleMappingStream_BatchedSnapshotSyncComplete(t *testing.T) {
-	checker := health.NewChecker(nil, nil)
-	s := &Server{
-		Logger:        log.StandardLogger(),
-		healthChecker: checker,
-		routerReady:   closedChan(),
-		lastMappings:  make(map[types.ServiceID]*proto.ProxyMapping),
-	}
-
-	stream := &mockMappingStream{
-		messages: []*proto.GetMappingUpdateResponse{
-			{},                          // batch 1: no sync-complete
-			{},                          // batch 2: no sync-complete
-			{InitialSyncComplete: true}, // batch 3: sync done
-		},
-	}
-
-	syncDone := false
-	err := s.handleMappingStream(context.Background(), stream, &syncDone)
-	assert.NoError(t, err)
-	assert.True(t, syncDone, "sync should be marked done after final batch")
-}
-
-// TestHandleMappingStream_PostSyncDoesNotReconcile verifies that messages
-// arriving after InitialSyncComplete do not trigger a second reconciliation.
-func TestHandleMappingStream_PostSyncDoesNotReconcile(t *testing.T) {
-	s := &Server{
-		Logger:       log.StandardLogger(),
-		routerReady:  closedChan(),
-		lastMappings: make(map[types.ServiceID]*proto.ProxyMapping),
-	}
-
-	// Simulate state left over from a previous sync.
-	s.lastMappings["svc-1"] = &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1"}
-	s.lastMappings["svc-2"] = &proto.ProxyMapping{Id: "svc-2", AccountId: "acct-1"}
-
-	stream := &mockMappingStream{
-		messages: []*proto.GetMappingUpdateResponse{
-			{}, // post-sync empty message — must not reconcile
-		},
-	}
-
-	syncDone := true // sync already completed in a previous stream
-	err := s.handleMappingStream(context.Background(), stream, &syncDone)
-	require.NoError(t, err)
-
-	assert.Len(t, s.lastMappings, 2,
-		"post-sync messages must not trigger reconciliation — all entries should survive")
-}
-
-// TestHandleMappingStream_ImmediateEOF_NoReconciliation verifies that if the
-// stream closes before sync completes, no reconciliation occurs.
-func TestHandleMappingStream_ImmediateEOF_NoReconciliation(t *testing.T) {
-	s := &Server{
-		Logger:       log.StandardLogger(),
-		routerReady:  closedChan(),
-		lastMappings: make(map[types.ServiceID]*proto.ProxyMapping),
-	}
-
-	s.lastMappings["svc-stale"] = &proto.ProxyMapping{Id: "svc-stale", AccountId: "acct-1"}
-
-	stream := &mockMappingStream{} // no messages → immediate EOF
-
-	syncDone := false
-	err := s.handleMappingStream(context.Background(), stream, &syncDone)
-	assert.NoError(t, err)
-	assert.False(t, syncDone, "sync should not be marked done on immediate EOF")
-
-	_, hasStale := s.lastMappings["svc-stale"]
-	assert.True(t, hasStale, "stale mapping should remain when sync never completed")
-}
-
-// mockErrRecvStream returns an error on the second Recv to verify
-// handleMappingStream returns without completing sync.
-type mockErrRecvStream struct {
-	mockMappingStream
-	calls int
-}
-
-func (m *mockErrRecvStream) Recv() (*proto.GetMappingUpdateResponse, error) {
-	m.calls++
-	if m.calls == 1 {
-		return &proto.GetMappingUpdateResponse{}, nil
-	}
-	return nil, io.ErrUnexpectedEOF
-}
-
-func TestHandleMappingStream_ErrorMidSync_NoReconciliation(t *testing.T) {
-	s := &Server{
-		Logger:       log.StandardLogger(),
-		routerReady:  closedChan(),
-		lastMappings: make(map[types.ServiceID]*proto.ProxyMapping),
-	}
-
-	s.lastMappings["svc-stale"] = &proto.ProxyMapping{Id: "svc-stale", AccountId: "acct-1"}
-
-	syncDone := false
-	err := s.handleMappingStream(context.Background(), &mockErrRecvStream{}, &syncDone)
-	assert.Error(t, err)
-	assert.False(t, syncDone)
-
-	_, hasStale := s.lastMappings["svc-stale"]
-	assert.True(t, hasStale, "stale mapping should remain when sync was interrupted by error")
-}

util/capture/text.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
+	"github.com/miekg/dns"
 )
 
 // TextWriter writes human-readable one-line-per-packet summaries.
@@ -592,19 +593,45 @@ func formatDNSResponse(d *layers.DNS, rd string, plen int) string {
 	anCount := d.ANCount
 	nsCount := d.NSCount
 	arCount := d.ARCount
+	ede := formatEDE(d)
 
 	if d.ResponseCode != layers.DNSResponseCodeNoErr {
-		return fmt.Sprintf("%04x %d/%d/%d %s (%d)", d.ID, anCount, nsCount, arCount, d.ResponseCode, plen)
+		return fmt.Sprintf("%04x %d/%d/%d %s%s (%d)", d.ID, anCount, nsCount, arCount, d.ResponseCode, ede, plen)
 	}
 
 	if anCount > 0 && len(d.Answers) > 0 {
 		rr := d.Answers[0]
 		if rdata := shortRData(&rr); rdata != "" {
-			return fmt.Sprintf("%04x %d/%d/%d %s %s (%d)", d.ID, anCount, nsCount, arCount, rr.Type, rdata, plen)
+			return fmt.Sprintf("%04x %d/%d/%d %s %s%s (%d)", d.ID, anCount, nsCount, arCount, rr.Type, rdata, ede, plen)
 		}
 	}
 
-	return fmt.Sprintf("%04x %d/%d/%d (%d)", d.ID, anCount, nsCount, arCount, plen)
+	return fmt.Sprintf("%04x %d/%d/%d%s (%d)", d.ID, anCount, nsCount, arCount, ede, plen)
+}
+
+// dnsOPTCodeEDE is the EDNS0 option code for Extended DNS Errors (RFC 8914).
+const dnsOPTCodeEDE layers.DNSOptionCode = layers.DNSOptionCode(dns.EDNS0EDE)
+
+// formatEDE returns " EDE=Name" for the first Extended DNS Error option
+// found in the response, or empty string if none is present.
+func formatEDE(d *layers.DNS) string {
+	for _, rr := range d.Additionals {
+		if rr.Type != layers.DNSTypeOPT {
+			continue
+		}
+		for _, opt := range rr.OPT {
+			if opt.Code != dnsOPTCodeEDE || len(opt.Data) < 2 {
+				continue
+			}
+			info := binary.BigEndian.Uint16(opt.Data[:2])
+			name, ok := dns.ExtendedErrorCodeToString[info]
+			if !ok {
+				name = fmt.Sprintf("%d", info)
+			}
+			return " EDE=" + name
+		}
+	}
+	return ""
 }
 
 func shortRData(rr *layers.DNSResourceRecord) string {