Package dns

Domain normalization, syntax validation, DNS pre-flight resolution checks, and multi-resolver consistency cross-checks. Sources: internal/dns/dns.go, internal/dns/resolvers.go.

func NormalizeDomain(d string) string

Lowercases the input and strips scheme, path, port, and trailing dot. Mirrors the shell normalize_domain helper.

dns.NormalizeDomain("HTTPS://Example.COM:8443/path")
// => "example.com"

func ValidSyntax(d string) bool

Reports whether d looks like a dotted domain name: labels of alphanumerics and hyphens with at least one dot. Used to reject malformed input before any network call.

dns.ValidSyntax("jdsoft.com")  // => true
dns.ValidSyntax("no-dot")      // => false

type DomainCheck struct {
    SystemLive bool
    PublicLive bool
    Consistency Consistency
}

One domain's full probe: system liveness for pre-flight gating, public liveness for suppression attribution, and the aggregate consistency verdict. The pre-flight gate aborts on system failure and reuses these outcomes downstream, so each resolver is queried exactly once per domain.

func CheckDomain(ctx context.Context, domain string, timeout time.Duration) DomainCheck

Probes the system resolver and pinned public resolvers once. Use SystemLive for NXDOMAIN gating and Consistency for scoring and messaging.

type Consistency struct {
    Checked  bool
    Tampered bool
    Kind     SplitKind
    Detail   string
}

Verdict of a multi-resolver cross-check. Detail names the disagreeing resolvers and the split kind when tampered.

const (
    SplitNone SplitKind = iota
    SplitSuppression
    SplitHorizon
    SplitNS
)

Split direction. Suppression (system dark, public live) signals local tampering; horizon (system live, public dark) is the expected split-horizon shape of internal names and never scores; NS marks delegation splits.

func CheckConsistency(ctx context.Context, domain string, timeout time.Duration) Consistency

Queries the system resolver plus pinned 1.1.1.1 and 8.8.8.8 servers in parallel (stdlib net.Resolver with a pinned dialer; filtered resolvers excluded by design). Flags NXDOMAIN-vs-live splits and NS delegation splits; raw A records are never compared, so CDN/GeoDNS churn stays quiet. Inconclusive resolvers abstain, and fewer than two conclusive votes is never tampering. Never fails closed.