remove offline_access from device default scopes

README.md

@@ -38,11 +38,6 @@
  
 </strong>
 <br>
-<strong>
-  🚀 <a href="https://careers.netbird.io">We are hiring! Join us at careers.netbird.io</a>
-</strong>
-<br>
-<br>
 <a href="https://registry.terraform.io/providers/netbirdio/netbird/latest">
     New: NetBird terraform provider
   </a> 

client/internal/dns.go

@@ -76,7 +76,7 @@ func collectPTRRecords(config *nbdns.Config, prefix netip.Prefix) []nbdns.Simple
 	var records []nbdns.SimpleRecord
 
 	for _, zone := range config.CustomZones {
-		if zone.NonAuthoritative {
+		if zone.SkipPTRProcess {
 			continue
 		}
 		for _, record := range zone.Records {

client/internal/dns/handler_chain.go

@@ -3,15 +3,11 @@ package dns
 import (
 	"fmt"
 	"slices"
-	"strconv"
 	"strings"
 	"sync"
-	"time"
 
 	"github.com/miekg/dns"
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 )
 
 const (
@@ -47,23 +43,7 @@ type HandlerChain struct {
 type ResponseWriterChain struct {
 	dns.ResponseWriter
 	origPattern    string
-	requestID      string
 	shouldContinue bool
-	response       *dns.Msg
-	meta           map[string]string
-}
-
-// RequestID returns the request ID for tracing
-func (w *ResponseWriterChain) RequestID() string {
-	return w.requestID
-}
-
-// SetMeta sets a metadata key-value pair for logging
-func (w *ResponseWriterChain) SetMeta(key, value string) {
-	if w.meta == nil {
-		w.meta = make(map[string]string)
-	}
-	w.meta[key] = value
 }
 
 func (w *ResponseWriterChain) WriteMsg(m *dns.Msg) error {
@@ -72,7 +52,6 @@ func (w *ResponseWriterChain) WriteMsg(m *dns.Msg) error {
 		w.shouldContinue = true
 		return nil
 	}
-	w.response = m
 	return w.ResponseWriter.WriteMsg(m)
 }
 
@@ -122,8 +101,6 @@ func (c *HandlerChain) AddHandler(pattern string, handler dns.Handler, priority
 
 	pos := c.findHandlerPosition(entry)
 	c.handlers = append(c.handlers[:pos], append([]HandlerEntry{entry}, c.handlers[pos:]...)...)
-
-	c.logHandlers()
 }
 
 // findHandlerPosition determines where to insert a new handler based on priority and specificity
@@ -163,109 +140,68 @@ func (c *HandlerChain) removeEntry(pattern string, priority int) {
 	for i := len(c.handlers) - 1; i >= 0; i-- {
 		entry := c.handlers[i]
 		if strings.EqualFold(entry.OrigPattern, pattern) && entry.Priority == priority {
-			log.Debugf("removing handler pattern: domain=%s priority=%d", entry.OrigPattern, priority)
 			c.handlers = append(c.handlers[:i], c.handlers[i+1:]...)
-			c.logHandlers()
 			break
 		}
 	}
 }
 
-// logHandlers logs the current handler chain state. Caller must hold the lock.
-func (c *HandlerChain) logHandlers() {
-	if !log.IsLevelEnabled(log.TraceLevel) {
-		return
-	}
-
-	var b strings.Builder
-	b.WriteString("handler chain (" + strconv.Itoa(len(c.handlers)) + "):\n")
-	for _, h := range c.handlers {
-		b.WriteString("  - pattern: domain=" + h.Pattern + " original: domain=" + h.OrigPattern +
-			" wildcard=" + strconv.FormatBool(h.IsWildcard) +
-			" match_subdomain=" + strconv.FormatBool(h.MatchSubdomains) +
-			" priority=" + strconv.Itoa(h.Priority) + "\n")
-	}
-	log.Trace(strings.TrimSuffix(b.String(), "\n"))
-}
-
 func (c *HandlerChain) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 	if len(r.Question) == 0 {
 		return
 	}
 
-	startTime := time.Now()
-	requestID := resutil.GenerateRequestID()
-	logger := log.WithFields(log.Fields{
-		"request_id": requestID,
-		"dns_id":     fmt.Sprintf("%04x", r.Id),
-	})
-
-	question := r.Question[0]
-	qname := strings.ToLower(question.Name)
+	qname := strings.ToLower(r.Question[0].Name)
 
 	c.mu.RLock()
 	handlers := slices.Clone(c.handlers)
 	c.mu.RUnlock()
 
+	if log.IsLevelEnabled(log.TraceLevel) {
+		var b strings.Builder
+		b.WriteString(fmt.Sprintf("DNS request domain=%s, handlers (%d):\n", qname, len(handlers)))
+		for _, h := range handlers {
+			b.WriteString(fmt.Sprintf("  - pattern: domain=%s original: domain=%s wildcard=%v match_subdomain=%v priority=%d\n",
+				h.Pattern, h.OrigPattern, h.IsWildcard, h.MatchSubdomains, h.Priority))
+		}
+		log.Trace(strings.TrimSuffix(b.String(), "\n"))
+	}
+
 	// Try handlers in priority order
 	for _, entry := range handlers {
-		if !c.isHandlerMatch(qname, entry) {
-			continue
-		}
+		matched := c.isHandlerMatch(qname, entry)
 
-		handlerName := entry.OrigPattern
-		if s, ok := entry.Handler.(interface{ String() string }); ok {
-			handlerName = s.String()
-		}
+		if matched {
+			log.Tracef("handler matched: domain=%s -> pattern=%s wildcard=%v match_subdomain=%v priority=%d",
+				qname, entry.OrigPattern, entry.IsWildcard, entry.MatchSubdomains, entry.Priority)
 
-		logger.Tracef("question: domain=%s type=%s class=%s -> handler=%s pattern=%s wildcard=%v match_subdomain=%v priority=%d",
-			qname, dns.TypeToString[question.Qtype], dns.ClassToString[question.Qclass],
-			handlerName, entry.OrigPattern, entry.IsWildcard, entry.MatchSubdomains, entry.Priority)
-
-		chainWriter := &ResponseWriterChain{
-			ResponseWriter: w,
-			origPattern:    entry.OrigPattern,
-			requestID:      requestID,
-		}
-		entry.Handler.ServeDNS(chainWriter, r)
-
-		// If handler wants to continue, try next handler
-		if chainWriter.shouldContinue {
-			if entry.Priority != PriorityMgmtCache {
-				logger.Tracef("handler requested continue for domain=%s", qname)
+			chainWriter := &ResponseWriterChain{
+				ResponseWriter: w,
+				origPattern:    entry.OrigPattern,
 			}
-			continue
-		}
+			entry.Handler.ServeDNS(chainWriter, r)
 
-		c.logResponse(logger, chainWriter, qname, startTime)
-		return
+			// If handler wants to continue, try next handler
+			if chainWriter.shouldContinue {
+				// Only log continue for non-management cache handlers to reduce noise
+				if entry.Priority != PriorityMgmtCache {
+					log.Tracef("handler requested continue to next handler for domain=%s", qname)
+				}
+				continue
+			}
+			return
+		}
 	}
 
 	// No handler matched or all handlers passed
-	logger.Tracef("no handler found for domain=%s type=%s class=%s",
-		qname, dns.TypeToString[question.Qtype], dns.ClassToString[question.Qclass])
+	log.Tracef("no handler found for domain=%s", qname)
 	resp := &dns.Msg{}
 	resp.SetRcode(r, dns.RcodeRefused)
 	if err := w.WriteMsg(resp); err != nil {
-		logger.Errorf("failed to write DNS response: %v", err)
+		log.Errorf("failed to write DNS response: %v", err)
 	}
 }
 
-func (c *HandlerChain) logResponse(logger *log.Entry, cw *ResponseWriterChain, qname string, startTime time.Time) {
-	if cw.response == nil {
-		return
-	}
-
-	var meta string
-	for k, v := range cw.meta {
-		meta += " " + k + "=" + v
-	}
-
-	logger.Tracef("response: domain=%s rcode=%s answers=%s%s took=%s",
-		qname, dns.RcodeToString[cw.response.Rcode], resutil.FormatAnswers(cw.response.Answer),
-		meta, time.Since(startTime))
-}
-
 func (c *HandlerChain) isHandlerMatch(qname string, entry HandlerEntry) bool {
 	switch {
 	case entry.Pattern == ".":

client/internal/dns/local/local.go

@@ -1,52 +1,30 @@
 package local
 
 import (
-	"context"
-	"errors"
 	"fmt"
-	"net"
-	"net/netip"
 	"slices"
 	"strings"
 	"sync"
-	"time"
 
 	"github.com/miekg/dns"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/exp/maps"
 
-	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/dns/types"
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
-const externalResolutionTimeout = 4 * time.Second
-
-type resolver interface {
-	LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
-}
-
 type Resolver struct {
 	mu      sync.RWMutex
 	records map[dns.Question][]dns.RR
 	domains map[domain.Domain]struct{}
-	// zones maps zone domain -> NonAuthoritative (true = non-authoritative, user-created zone)
-	zones    map[domain.Domain]bool
-	resolver resolver
-
-	ctx    context.Context
-	cancel context.CancelFunc
 }
 
 func NewResolver() *Resolver {
-	ctx, cancel := context.WithCancel(context.Background())
 	return &Resolver{
 		records: make(map[dns.Question][]dns.RR),
 		domains: make(map[domain.Domain]struct{}),
-		zones:   make(map[domain.Domain]bool),
-		ctx:     ctx,
-		cancel:  cancel,
 	}
 }
 
@@ -59,18 +37,7 @@ func (d *Resolver) String() string {
 	return fmt.Sprintf("LocalResolver [%d records]", len(d.records))
 }
 
-func (d *Resolver) Stop() {
-	if d.cancel != nil {
-		d.cancel()
-	}
-
-	d.mu.Lock()
-	defer d.mu.Unlock()
-
-	maps.Clear(d.records)
-	maps.Clear(d.domains)
-	maps.Clear(d.zones)
-}
+func (d *Resolver) Stop() {}
 
 // ID returns the unique handler ID
 func (d *Resolver) ID() types.HandlerID {
@@ -81,85 +48,35 @@ func (d *Resolver) ProbeAvailability() {}
 
 // ServeDNS handles a DNS request
 func (d *Resolver) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
-	logger := log.WithField("request_id", resutil.GetRequestID(w))
-
 	if len(r.Question) == 0 {
-		logger.Debug("received local resolver request with no question")
+		log.Debugf("received local resolver request with no question")
 		return
 	}
 	question := r.Question[0]
 	question.Name = strings.ToLower(dns.Fqdn(question.Name))
 
+	log.Tracef("received local question: domain=%s type=%v class=%v", r.Question[0].Name, question.Qtype, question.Qclass)
+
 	replyMessage := &dns.Msg{}
 	replyMessage.SetReply(r)
 	replyMessage.RecursionAvailable = true
 
-	result := d.lookupRecords(logger, question)
-	replyMessage.Authoritative = !result.hasExternalData
-	replyMessage.Answer = result.records
-	replyMessage.Rcode = d.determineRcode(question, result)
-
-	if replyMessage.Rcode == dns.RcodeNameError && d.shouldFallthrough(question.Name) {
-		d.continueToNext(logger, w, r)
-		return
+	// lookup all records matching the question
+	records := d.lookupRecords(question)
+	if len(records) > 0 {
+		replyMessage.Rcode = dns.RcodeSuccess
+		replyMessage.Answer = append(replyMessage.Answer, records...)
+	} else {
+		// Check if we have any records for this domain name with different types
+		if d.hasRecordsForDomain(domain.Domain(question.Name)) {
+			replyMessage.Rcode = dns.RcodeSuccess // NOERROR with 0 records
+		} else {
+			replyMessage.Rcode = dns.RcodeNameError // NXDOMAIN
+		}
 	}
 
 	if err := w.WriteMsg(replyMessage); err != nil {
-		logger.Warnf("failed to write the local resolver response: %v", err)
-	}
-}
-
-// determineRcode returns the appropriate DNS response code.
-// Per RFC 6604, CNAME chains should return the rcode of the final target resolution,
-// even if CNAME records are included in the answer.
-func (d *Resolver) determineRcode(question dns.Question, result lookupResult) int {
-	// Use the rcode from lookup - this properly handles CNAME chains where
-	// the target may be NXDOMAIN or SERVFAIL even though we have CNAME records
-	if result.rcode != 0 {
-		return result.rcode
-	}
-
-	// No records found, but domain exists with different record types (NODATA)
-	if d.hasRecordsForDomain(domain.Domain(question.Name)) {
-		return dns.RcodeSuccess
-	}
-
-	return dns.RcodeNameError
-}
-
-// findZone finds the matching zone for a query name using reverse suffix lookup.
-// Returns (nonAuthoritative, found). This is O(k) where k = number of labels in qname.
-func (d *Resolver) findZone(qname string) (nonAuthoritative bool, found bool) {
-	qname = strings.ToLower(dns.Fqdn(qname))
-	for {
-		if nonAuth, ok := d.zones[domain.Domain(qname)]; ok {
-			return nonAuth, true
-		}
-		// Move to parent domain
-		idx := strings.Index(qname, ".")
-		if idx == -1 || idx == len(qname)-1 {
-			return false, false
-		}
-		qname = qname[idx+1:]
-	}
-}
-
-// shouldFallthrough checks if the query should fallthrough to the next handler.
-// Returns true if the queried name belongs to a non-authoritative zone.
-func (d *Resolver) shouldFallthrough(qname string) bool {
-	d.mu.RLock()
-	defer d.mu.RUnlock()
-
-	nonAuth, found := d.findZone(qname)
-	return found && nonAuth
-}
-
-func (d *Resolver) continueToNext(logger *log.Entry, w dns.ResponseWriter, r *dns.Msg) {
-	resp := &dns.Msg{}
-	resp.SetRcode(r, dns.RcodeNameError)
-	resp.MsgHdr.Zero = true
-	if err := w.WriteMsg(resp); err != nil {
-		logger.Warnf("failed to write continue signal: %v", err)
+		log.Warnf("failed to write the local resolver response: %v", err)
 	}
 }
 
@@ -172,27 +89,8 @@ func (d *Resolver) hasRecordsForDomain(domainName domain.Domain) bool {
 	return exists
 }
 
-// isInManagedZone checks if the given name falls within any of our managed zones.
-// This is used to avoid unnecessary external resolution for CNAME targets that
-// are within zones we manage - if we don't have a record for it, it doesn't exist.
-// Caller must NOT hold the lock.
-func (d *Resolver) isInManagedZone(name string) bool {
-	d.mu.RLock()
-	defer d.mu.RUnlock()
-
-	_, found := d.findZone(name)
-	return found
-}
-
-// lookupResult contains the result of a DNS lookup operation.
-type lookupResult struct {
-	records         []dns.RR
-	rcode           int
-	hasExternalData bool
-}
-
 // lookupRecords fetches *all* DNS records matching the first question in r.
-func (d *Resolver) lookupRecords(logger *log.Entry, question dns.Question) lookupResult {
+func (d *Resolver) lookupRecords(question dns.Question) []dns.RR {
 	d.mu.RLock()
 	records, found := d.records[question]
 
@@ -200,14 +98,10 @@ func (d *Resolver) lookupRecords(logger *log.Entry, question dns.Question) looku
 		d.mu.RUnlock()
 		// alternatively check if we have a cname
 		if question.Qtype != dns.TypeCNAME {
-			cnameQuestion := dns.Question{
-				Name:   question.Name,
-				Qtype:  dns.TypeCNAME,
-				Qclass: question.Qclass,
-			}
-			return d.lookupCNAMEChain(logger, cnameQuestion, question.Qtype)
+			question.Qtype = dns.TypeCNAME
+			return d.lookupRecords(question)
 		}
-		return lookupResult{rcode: dns.RcodeNameError}
+		return nil
 	}
 
 	recordsCopy := slices.Clone(records)
@@ -225,178 +119,20 @@ func (d *Resolver) lookupRecords(logger *log.Entry, question dns.Question) looku
 		d.mu.Unlock()
 	}
 
-	return lookupResult{records: recordsCopy, rcode: dns.RcodeSuccess}
+	return recordsCopy
 }
 
-// lookupCNAMEChain follows a CNAME chain and returns the CNAME records along with
-// the final resolved record of the requested type. This is required for musl libc
-// compatibility, which expects the full answer chain rather than just the CNAME.
-func (d *Resolver) lookupCNAMEChain(logger *log.Entry, cnameQuestion dns.Question, targetType uint16) lookupResult {
-	const maxDepth = 8
-	var chain []dns.RR
-
-	for range maxDepth {
-		cnameRecords := d.getRecords(cnameQuestion)
-		if len(cnameRecords) == 0 {
-			break
-		}
-
-		chain = append(chain, cnameRecords...)
-
-		cname, ok := cnameRecords[0].(*dns.CNAME)
-		if !ok {
-			break
-		}
-
-		targetName := strings.ToLower(cname.Target)
-		targetResult := d.resolveCNAMETarget(logger, targetName, targetType, cnameQuestion.Qclass)
-
-		// keep following chain
-		if targetResult.rcode == -1 {
-			cnameQuestion = dns.Question{Name: targetName, Qtype: dns.TypeCNAME, Qclass: cnameQuestion.Qclass}
-			continue
-		}
-
-		return d.buildChainResult(chain, targetResult)
-	}
-
-	if len(chain) > 0 {
-		return lookupResult{records: chain, rcode: dns.RcodeSuccess}
-	}
-	return lookupResult{rcode: dns.RcodeSuccess}
-}
-
-// buildChainResult combines CNAME chain records with the target resolution result.
-// Per RFC 6604, the final rcode is propagated through the chain.
-func (d *Resolver) buildChainResult(chain []dns.RR, target lookupResult) lookupResult {
-	records := chain
-	if len(target.records) > 0 {
-		records = append(records, target.records...)
-	}
-
-	// preserve hasExternalData for SERVFAIL so caller knows the error came from upstream
-	if target.hasExternalData && target.rcode == dns.RcodeServerFailure {
-		return lookupResult{
-			records:         records,
-			rcode:           dns.RcodeServerFailure,
-			hasExternalData: true,
-		}
-	}
-
-	return lookupResult{
-		records:         records,
-		rcode:           target.rcode,
-		hasExternalData: target.hasExternalData,
-	}
-}
-
-// resolveCNAMETarget attempts to resolve a CNAME target name.
-// Returns rcode=-1 to signal "keep following the chain".
-func (d *Resolver) resolveCNAMETarget(logger *log.Entry, targetName string, targetType uint16, qclass uint16) lookupResult {
-	if records := d.getRecords(dns.Question{Name: targetName, Qtype: targetType, Qclass: qclass}); len(records) > 0 {
-		return lookupResult{records: records, rcode: dns.RcodeSuccess}
-	}
-
-	// another CNAME, keep following
-	if d.hasRecord(dns.Question{Name: targetName, Qtype: dns.TypeCNAME, Qclass: qclass}) {
-		return lookupResult{rcode: -1}
-	}
-
-	// domain exists locally but not this record type (NODATA)
-	if d.hasRecordsForDomain(domain.Domain(targetName)) {
-		return lookupResult{rcode: dns.RcodeSuccess}
-	}
-
-	// in our zone but doesn't exist (NXDOMAIN)
-	if d.isInManagedZone(targetName) {
-		return lookupResult{rcode: dns.RcodeNameError}
-	}
-
-	return d.resolveExternal(logger, targetName, targetType)
-}
-
-func (d *Resolver) getRecords(q dns.Question) []dns.RR {
-	d.mu.RLock()
-	defer d.mu.RUnlock()
-	return d.records[q]
-}
-
-func (d *Resolver) hasRecord(q dns.Question) bool {
-	d.mu.RLock()
-	defer d.mu.RUnlock()
-	_, ok := d.records[q]
-	return ok
-}
-
-// resolveExternal resolves a domain name using the system resolver.
-// This is used to resolve CNAME targets that point outside our local zone,
-// which is required for musl libc compatibility (musl expects complete answers).
-func (d *Resolver) resolveExternal(logger *log.Entry, name string, qtype uint16) lookupResult {
-	network := resutil.NetworkForQtype(qtype)
-	if network == "" {
-		return lookupResult{rcode: dns.RcodeNotImplemented}
-	}
-
-	resolver := d.resolver
-	if resolver == nil {
-		resolver = net.DefaultResolver
-	}
-
-	ctx, cancel := context.WithTimeout(d.ctx, externalResolutionTimeout)
-	defer cancel()
-
-	result := resutil.LookupIP(ctx, resolver, network, name, qtype)
-	if result.Err != nil {
-		d.logDNSError(logger, name, qtype, result.Err)
-		return lookupResult{rcode: result.Rcode, hasExternalData: true}
-	}
-
-	return lookupResult{
-		records:         resutil.IPsToRRs(name, result.IPs, 60),
-		rcode:           dns.RcodeSuccess,
-		hasExternalData: true,
-	}
-}
-
-// logDNSError logs DNS resolution errors for debugging.
-func (d *Resolver) logDNSError(logger *log.Entry, hostname string, qtype uint16, err error) {
-	qtypeName := dns.TypeToString[qtype]
-
-	var dnsErr *net.DNSError
-	if !errors.As(err, &dnsErr) {
-		logger.Debugf("DNS resolution failed for %s type %s: %v", hostname, qtypeName, err)
-		return
-	}
-
-	if dnsErr.IsNotFound {
-		logger.Tracef("DNS target not found: %s type %s", hostname, qtypeName)
-		return
-	}
-
-	if dnsErr.Server != "" {
-		logger.Debugf("DNS resolution failed for %s type %s server=%s: %v", hostname, qtypeName, dnsErr.Server, err)
-	} else {
-		logger.Debugf("DNS resolution failed for %s type %s: %v", hostname, qtypeName, err)
-	}
-}
-
-// Update replaces all zones and their records
-func (d *Resolver) Update(customZones []nbdns.CustomZone) {
+func (d *Resolver) Update(update []nbdns.SimpleRecord) {
 	d.mu.Lock()
 	defer d.mu.Unlock()
 
 	maps.Clear(d.records)
 	maps.Clear(d.domains)
-	maps.Clear(d.zones)
 
-	for _, zone := range customZones {
-		zoneDomain := domain.Domain(strings.ToLower(dns.Fqdn(zone.Domain)))
-		d.zones[zoneDomain] = zone.NonAuthoritative
-
-		for _, rec := range zone.Records {
-			if err := d.registerRecord(rec); err != nil {
-				log.Warnf("failed to register the record (%s): %v", rec, err)
-			}
+	for _, rec := range update {
+		if err := d.registerRecord(rec); err != nil {
+			log.Warnf("failed to register the record (%s): %v", rec, err)
+			continue
 		}
 	}
 }

client/internal/dns/local/local_test.go

@@ -1,14 +1,8 @@
 package local
 
 import (
-	"context"
-	"fmt"
-	"net"
-	"net/netip"
 	"strings"
-	"sync"
 	"testing"
-	"time"
 
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
@@ -18,18 +12,6 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 )
 
-// mockResolver implements resolver for testing
-type mockResolver struct {
-	lookupFunc func(ctx context.Context, network, host string) ([]netip.Addr, error)
-}
-
-func (m *mockResolver) LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error) {
-	if m.lookupFunc != nil {
-		return m.lookupFunc(ctx, network, host)
-	}
-	return nil, nil
-}
-
 func TestLocalResolver_ServeDNS(t *testing.T) {
 	recordA := nbdns.SimpleRecord{
 		Name:  "peera.netbird.cloud.",
@@ -124,11 +106,11 @@ func TestLocalResolver_Update_StaleRecord(t *testing.T) {
 
 	resolver := NewResolver()
 
-	zone1 := []nbdns.CustomZone{{Domain: "example.com.", Records: []nbdns.SimpleRecord{record1}}}
-	zone2 := []nbdns.CustomZone{{Domain: "example.com.", Records: []nbdns.SimpleRecord{record2}}}
+	update1 := []nbdns.SimpleRecord{record1}
+	update2 := []nbdns.SimpleRecord{record2}
 
 	// Apply first update
-	resolver.Update(zone1)
+	resolver.Update(update1)
 
 	// Verify first update
 	resolver.mu.RLock()
@@ -140,7 +122,7 @@ func TestLocalResolver_Update_StaleRecord(t *testing.T) {
 	assert.Contains(t, rrSlice1[0].String(), record1.RData, "Record after first update should be %s", record1.RData)
 
 	// Apply second update
-	resolver.Update(zone2)
+	resolver.Update(update2)
 
 	// Verify second update
 	resolver.mu.RLock()
@@ -169,10 +151,10 @@ func TestLocalResolver_MultipleRecords_SameQuestion(t *testing.T) {
 		Name: recordName, Type: int(recordType), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.2",
 	}
 
-	zones := []nbdns.CustomZone{{Domain: "example.com.", Records: []nbdns.SimpleRecord{record1, record2}}}
+	update := []nbdns.SimpleRecord{record1, record2}
 
 	// Apply update with both records
-	resolver.Update(zones)
+	resolver.Update(update)
 
 	// Create question that matches both records
 	question := dns.Question{
@@ -213,10 +195,10 @@ func TestLocalResolver_RecordRotation(t *testing.T) {
 		Name: recordName, Type: int(recordType), Class: nbdns.DefaultClass, TTL: 300, RData: "192.168.1.3",
 	}
 
-	zones := []nbdns.CustomZone{{Domain: "example.com.", Records: []nbdns.SimpleRecord{record1, record2, record3}}}
+	update := []nbdns.SimpleRecord{record1, record2, record3}
 
 	// Apply update with all three records
-	resolver.Update(zones)
+	resolver.Update(update)
 
 	msg := new(dns.Msg).SetQuestion(recordName, recordType)
 
@@ -282,7 +264,7 @@ func TestLocalResolver_CaseInsensitiveMatching(t *testing.T) {
 	}
 
 	// Update resolver with the records
-	resolver.Update([]nbdns.CustomZone{{Domain: "example.com.", Records: []nbdns.SimpleRecord{lowerCaseRecord, mixedCaseRecord}}})
+	resolver.Update([]nbdns.SimpleRecord{lowerCaseRecord, mixedCaseRecord})
 
 	testCases := []struct {
 		name          string
@@ -397,7 +379,7 @@ func TestLocalResolver_CNAMEFallback(t *testing.T) {
 	}
 
 	// Update resolver with both records
-	resolver.Update([]nbdns.CustomZone{{Domain: "example.com.", Records: []nbdns.SimpleRecord{cnameRecord, targetRecord}}})
+	resolver.Update([]nbdns.SimpleRecord{cnameRecord, targetRecord})
 
 	testCases := []struct {
 		name          string
@@ -494,20 +476,6 @@ func TestLocalResolver_CNAMEFallback(t *testing.T) {
 // with 0 records instead of NXDOMAIN
 func TestLocalResolver_NoErrorWithDifferentRecordType(t *testing.T) {
 	resolver := NewResolver()
-	// Mock external resolver for CNAME target resolution
-	resolver.resolver = &mockResolver{
-		lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
-			if host == "target.example.com." {
-				if network == "ip4" {
-					return []netip.Addr{netip.MustParseAddr("93.184.216.34")}, nil
-				}
-				if network == "ip6" {
-					return []netip.Addr{netip.MustParseAddr("2606:2800:220:1:248:1893:25c8:1946")}, nil
-				}
-			}
-			return nil, &net.DNSError{IsNotFound: true, Name: host}
-		},
-	}
 
 	recordA := nbdns.SimpleRecord{
 		Name:  "example.netbird.cloud.",
@@ -525,7 +493,7 @@ func TestLocalResolver_NoErrorWithDifferentRecordType(t *testing.T) {
 		RData: "target.example.com.",
 	}
 
-	resolver.Update([]nbdns.CustomZone{{Domain: "netbird.cloud.", Records: []nbdns.SimpleRecord{recordA, recordCNAME}}})
+	resolver.Update([]nbdns.SimpleRecord{recordA, recordCNAME})
 
 	testCases := []struct {
 		name           string
@@ -614,808 +582,3 @@ func TestLocalResolver_NoErrorWithDifferentRecordType(t *testing.T) {
 		})
 	}
 }
-
-// TestLocalResolver_CNAMEChainResolution tests comprehensive CNAME chain following
-func TestLocalResolver_CNAMEChainResolution(t *testing.T) {
-	t.Run("simple internal CNAME chain", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "example.com.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "alias.example.com.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "target.example.com."},
-				{Name: "target.example.com.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "192.168.1.1"},
-			},
-		}})
-
-		msg := new(dns.Msg).SetQuestion("alias.example.com.", dns.TypeA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		require.Equal(t, dns.RcodeSuccess, resp.Rcode)
-		require.Len(t, resp.Answer, 2)
-
-		cname, ok := resp.Answer[0].(*dns.CNAME)
-		require.True(t, ok)
-		assert.Equal(t, "target.example.com.", cname.Target)
-
-		a, ok := resp.Answer[1].(*dns.A)
-		require.True(t, ok)
-		assert.Equal(t, "192.168.1.1", a.A.String())
-	})
-
-	t.Run("multi-hop CNAME chain", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "test.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "hop1.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "hop2.test."},
-				{Name: "hop2.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "hop3.test."},
-				{Name: "hop3.test.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
-			},
-		}})
-
-		msg := new(dns.Msg).SetQuestion("hop1.test.", dns.TypeA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		require.Equal(t, dns.RcodeSuccess, resp.Rcode)
-		require.Len(t, resp.Answer, 3)
-	})
-
-	t.Run("CNAME to non-existent internal target returns only CNAME", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "test.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "alias.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "nonexistent.test."},
-			},
-		}})
-
-		msg := new(dns.Msg).SetQuestion("alias.test.", dns.TypeA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		require.Len(t, resp.Answer, 1)
-		_, ok := resp.Answer[0].(*dns.CNAME)
-		assert.True(t, ok)
-	})
-}
-
-// TestLocalResolver_CNAMEMaxDepth tests the maximum depth limit for CNAME chains
-func TestLocalResolver_CNAMEMaxDepth(t *testing.T) {
-	t.Run("chain at max depth resolves", func(t *testing.T) {
-		resolver := NewResolver()
-		var records []nbdns.SimpleRecord
-		// Create chain of 7 CNAMEs (under max of 8)
-		for i := 1; i <= 7; i++ {
-			records = append(records, nbdns.SimpleRecord{
-				Name:  fmt.Sprintf("hop%d.test.", i),
-				Type:  int(dns.TypeCNAME),
-				Class: nbdns.DefaultClass,
-				TTL:   300,
-				RData: fmt.Sprintf("hop%d.test.", i+1),
-			})
-		}
-		records = append(records, nbdns.SimpleRecord{
-			Name: "hop8.test.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.10.10.10",
-		})
-
-		resolver.Update([]nbdns.CustomZone{{Domain: "test.", Records: records}})
-
-		msg := new(dns.Msg).SetQuestion("hop1.test.", dns.TypeA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		require.Equal(t, dns.RcodeSuccess, resp.Rcode)
-		require.Len(t, resp.Answer, 8)
-	})
-
-	t.Run("chain exceeding max depth stops", func(t *testing.T) {
-		resolver := NewResolver()
-		var records []nbdns.SimpleRecord
-		// Create chain of 10 CNAMEs (exceeds max of 8)
-		for i := 1; i <= 10; i++ {
-			records = append(records, nbdns.SimpleRecord{
-				Name:  fmt.Sprintf("deep%d.test.", i),
-				Type:  int(dns.TypeCNAME),
-				Class: nbdns.DefaultClass,
-				TTL:   300,
-				RData: fmt.Sprintf("deep%d.test.", i+1),
-			})
-		}
-		records = append(records, nbdns.SimpleRecord{
-			Name: "deep11.test.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.10.10.10",
-		})
-
-		resolver.Update([]nbdns.CustomZone{{Domain: "test.", Records: records}})
-
-		msg := new(dns.Msg).SetQuestion("deep1.test.", dns.TypeA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		// Should NOT have the final A record (chain too deep)
-		assert.LessOrEqual(t, len(resp.Answer), 8)
-	})
-
-	t.Run("circular CNAME is protected by max depth", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "test.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "loop1.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "loop2.test."},
-				{Name: "loop2.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "loop1.test."},
-			},
-		}})
-
-		msg := new(dns.Msg).SetQuestion("loop1.test.", dns.TypeA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		assert.LessOrEqual(t, len(resp.Answer), 8)
-	})
-}
-
-// TestLocalResolver_ExternalCNAMEResolution tests CNAME resolution to external domains
-func TestLocalResolver_ExternalCNAMEResolution(t *testing.T) {
-	t.Run("CNAME to external domain resolves via external resolver", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.resolver = &mockResolver{
-			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
-				if host == "external.example.com." && network == "ip4" {
-					return []netip.Addr{netip.MustParseAddr("93.184.216.34")}, nil
-				}
-				return nil, nil
-			},
-		}
-
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "test.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "alias.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.example.com."},
-			},
-		}})
-
-		msg := new(dns.Msg).SetQuestion("alias.test.", dns.TypeA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		require.Len(t, resp.Answer, 2, "Should have CNAME + A record")
-
-		cname, ok := resp.Answer[0].(*dns.CNAME)
-		require.True(t, ok)
-		assert.Equal(t, "external.example.com.", cname.Target)
-
-		a, ok := resp.Answer[1].(*dns.A)
-		require.True(t, ok)
-		assert.Equal(t, "93.184.216.34", a.A.String())
-	})
-
-	t.Run("CNAME to external domain resolves IPv6", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.resolver = &mockResolver{
-			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
-				if host == "external.example.com." && network == "ip6" {
-					return []netip.Addr{netip.MustParseAddr("2606:2800:220:1:248:1893:25c8:1946")}, nil
-				}
-				return nil, nil
-			},
-		}
-
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "test.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "alias.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.example.com."},
-			},
-		}})
-
-		msg := new(dns.Msg).SetQuestion("alias.test.", dns.TypeAAAA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		require.Len(t, resp.Answer, 2, "Should have CNAME + AAAA record")
-
-		cname, ok := resp.Answer[0].(*dns.CNAME)
-		require.True(t, ok)
-		assert.Equal(t, "external.example.com.", cname.Target)
-
-		aaaa, ok := resp.Answer[1].(*dns.AAAA)
-		require.True(t, ok)
-		assert.Equal(t, "2606:2800:220:1:248:1893:25c8:1946", aaaa.AAAA.String())
-	})
-
-	t.Run("concurrent external resolution", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.resolver = &mockResolver{
-			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
-				if host == "external.example.com." && network == "ip4" {
-					return []netip.Addr{netip.MustParseAddr("93.184.216.34")}, nil
-				}
-				return nil, nil
-			},
-		}
-
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "test.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "concurrent.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.example.com."},
-			},
-		}})
-
-		var wg sync.WaitGroup
-		results := make([]*dns.Msg, 10)
-
-		for i := 0; i < 10; i++ {
-			wg.Add(1)
-			go func(idx int) {
-				defer wg.Done()
-				msg := new(dns.Msg).SetQuestion("concurrent.test.", dns.TypeA)
-				var resp *dns.Msg
-				resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-				results[idx] = resp
-			}(i)
-		}
-		wg.Wait()
-
-		for i, resp := range results {
-			require.NotNil(t, resp, "Response %d should not be nil", i)
-			require.Len(t, resp.Answer, 2, "Response %d should have CNAME + A", i)
-		}
-	})
-}
-
-// TestLocalResolver_ZoneManagement tests zone-aware CNAME resolution
-func TestLocalResolver_ZoneManagement(t *testing.T) {
-	t.Run("Update sets zones correctly", func(t *testing.T) {
-		resolver := NewResolver()
-
-		resolver.Update([]nbdns.CustomZone{
-			{Domain: "example.com.", Records: []nbdns.SimpleRecord{
-				{Name: "host.example.com.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
-			}},
-			{Domain: "test.local."},
-		})
-
-		assert.True(t, resolver.isInManagedZone("host.example.com."))
-		assert.True(t, resolver.isInManagedZone("other.example.com."))
-		assert.True(t, resolver.isInManagedZone("sub.test.local."))
-		assert.False(t, resolver.isInManagedZone("external.com."))
-	})
-
-	t.Run("isInManagedZone case insensitive", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.Update([]nbdns.CustomZone{{Domain: "Example.COM."}})
-
-		assert.True(t, resolver.isInManagedZone("host.example.com."))
-		assert.True(t, resolver.isInManagedZone("HOST.EXAMPLE.COM."))
-	})
-
-	t.Run("Update clears zones", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.Update([]nbdns.CustomZone{{Domain: "example.com."}})
-		assert.True(t, resolver.isInManagedZone("host.example.com."))
-
-		resolver.Update(nil)
-		assert.False(t, resolver.isInManagedZone("host.example.com."))
-	})
-}
-
-// TestLocalResolver_CNAMEZoneAwareResolution tests CNAME resolution with zone awareness
-func TestLocalResolver_CNAMEZoneAwareResolution(t *testing.T) {
-	t.Run("CNAME target in managed zone returns NXDOMAIN per RFC 6604", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "myzone.test.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "alias.myzone.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "nonexistent.myzone.test."},
-			},
-		}})
-
-		msg := new(dns.Msg).SetQuestion("alias.myzone.test.", dns.TypeA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		assert.Equal(t, dns.RcodeNameError, resp.Rcode, "Should return NXDOMAIN")
-		require.Len(t, resp.Answer, 1, "Should include CNAME in answer")
-	})
-
-	t.Run("CNAME to external domain skips zone check", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.resolver = &mockResolver{
-			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
-				if host == "external.other.com." && network == "ip4" {
-					return []netip.Addr{netip.MustParseAddr("203.0.113.1")}, nil
-				}
-				return nil, nil
-			},
-		}
-
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "myzone.test.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "alias.myzone.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.other.com."},
-			},
-		}})
-
-		msg := new(dns.Msg).SetQuestion("alias.myzone.test.", dns.TypeA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		assert.Equal(t, dns.RcodeSuccess, resp.Rcode)
-		require.Len(t, resp.Answer, 2, "Should have CNAME + A from external resolution")
-	})
-
-	t.Run("CNAME target exists with different type returns NODATA not NXDOMAIN", func(t *testing.T) {
-		resolver := NewResolver()
-		// CNAME points to target that has A but no AAAA - query for AAAA should be NODATA
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "myzone.test.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "alias.myzone.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "target.myzone.test."},
-				{Name: "target.myzone.test.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "1.1.1.1"},
-			},
-		}})
-
-		msg := new(dns.Msg).SetQuestion("alias.myzone.test.", dns.TypeAAAA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		assert.Equal(t, dns.RcodeSuccess, resp.Rcode, "Should return NODATA (success), not NXDOMAIN")
-		require.Len(t, resp.Answer, 1, "Should have only CNAME, no AAAA")
-		_, ok := resp.Answer[0].(*dns.CNAME)
-		assert.True(t, ok, "Answer should be CNAME record")
-	})
-
-	t.Run("external CNAME target exists but no AAAA records (NODATA)", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.resolver = &mockResolver{
-			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
-				if host == "external.example.com." {
-					if network == "ip6" {
-						// No AAAA records
-						return nil, &net.DNSError{IsNotFound: true, Name: host}
-					}
-					if network == "ip4" {
-						// But A records exist - domain exists
-						return []netip.Addr{netip.MustParseAddr("93.184.216.34")}, nil
-					}
-				}
-				return nil, &net.DNSError{IsNotFound: true, Name: host}
-			},
-		}
-
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "test.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "alias.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.example.com."},
-			},
-		}})
-
-		msg := new(dns.Msg).SetQuestion("alias.test.", dns.TypeAAAA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		assert.Equal(t, dns.RcodeSuccess, resp.Rcode, "Should return NODATA (success), not NXDOMAIN")
-		require.Len(t, resp.Answer, 1, "Should have only CNAME")
-		_, ok := resp.Answer[0].(*dns.CNAME)
-		assert.True(t, ok, "Answer should be CNAME record")
-	})
-
-	// Table-driven test for all external resolution outcomes
-	externalCases := []struct {
-		name           string
-		lookupFunc     func(context.Context, string, string) ([]netip.Addr, error)
-		expectedRcode  int
-		expectedAnswer int
-	}{
-		{
-			name: "external NXDOMAIN (both A and AAAA not found)",
-			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
-				return nil, &net.DNSError{IsNotFound: true, Name: host}
-			},
-			expectedRcode:  dns.RcodeNameError,
-			expectedAnswer: 1, // CNAME only
-		},
-		{
-			name: "external SERVFAIL (temporary error)",
-			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
-				return nil, &net.DNSError{IsTemporary: true, Name: host}
-			},
-			expectedRcode:  dns.RcodeServerFailure,
-			expectedAnswer: 1, // CNAME only
-		},
-		{
-			name: "external SERVFAIL (timeout)",
-			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
-				return nil, &net.DNSError{IsTimeout: true, Name: host}
-			},
-			expectedRcode:  dns.RcodeServerFailure,
-			expectedAnswer: 1, // CNAME only
-		},
-		{
-			name: "external SERVFAIL (generic error)",
-			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
-				return nil, fmt.Errorf("connection refused")
-			},
-			expectedRcode:  dns.RcodeServerFailure,
-			expectedAnswer: 1, // CNAME only
-		},
-		{
-			name: "external success with IPs",
-			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
-				if network == "ip4" {
-					return []netip.Addr{netip.MustParseAddr("93.184.216.34")}, nil
-				}
-				return nil, &net.DNSError{IsNotFound: true, Name: host}
-			},
-			expectedRcode:  dns.RcodeSuccess,
-			expectedAnswer: 2, // CNAME + A
-		},
-	}
-
-	for _, tc := range externalCases {
-		t.Run(tc.name, func(t *testing.T) {
-			resolver := NewResolver()
-			resolver.resolver = &mockResolver{lookupFunc: tc.lookupFunc}
-
-			resolver.Update([]nbdns.CustomZone{{
-				Domain: "test.",
-				Records: []nbdns.SimpleRecord{
-					{Name: "alias.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.example.com."},
-				},
-			}})
-
-			msg := new(dns.Msg).SetQuestion("alias.test.", dns.TypeA)
-			var resp *dns.Msg
-			resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-			require.NotNil(t, resp)
-			assert.Equal(t, tc.expectedRcode, resp.Rcode, "rcode mismatch")
-			assert.Len(t, resp.Answer, tc.expectedAnswer, "answer count mismatch")
-			if tc.expectedAnswer > 0 {
-				_, ok := resp.Answer[0].(*dns.CNAME)
-				assert.True(t, ok, "first answer should be CNAME")
-			}
-		})
-	}
-}
-
-// TestLocalResolver_Fallthrough verifies that non-authoritative zones
-// trigger fallthrough (Zero bit set) when no records match
-func TestLocalResolver_Fallthrough(t *testing.T) {
-	resolver := NewResolver()
-
-	record := nbdns.SimpleRecord{
-		Name:  "existing.custom.zone.",
-		Type:  int(dns.TypeA),
-		Class: nbdns.DefaultClass,
-		TTL:   300,
-		RData: "10.0.0.1",
-	}
-
-	testCases := []struct {
-		name              string
-		zones             []nbdns.CustomZone
-		queryName         string
-		expectFallthrough bool
-		expectRecord      bool
-	}{
-		{
-			name: "Authoritative zone returns NXDOMAIN without fallthrough",
-			zones: []nbdns.CustomZone{{
-				Domain:  "custom.zone.",
-				Records: []nbdns.SimpleRecord{record},
-			}},
-			queryName:         "nonexistent.custom.zone.",
-			expectFallthrough: false,
-			expectRecord:      false,
-		},
-		{
-			name: "Non-authoritative zone triggers fallthrough",
-			zones: []nbdns.CustomZone{{
-				Domain:           "custom.zone.",
-				Records:          []nbdns.SimpleRecord{record},
-				NonAuthoritative: true,
-			}},
-			queryName:         "nonexistent.custom.zone.",
-			expectFallthrough: true,
-			expectRecord:      false,
-		},
-		{
-			name: "Record found in non-authoritative zone returns normally",
-			zones: []nbdns.CustomZone{{
-				Domain:           "custom.zone.",
-				Records:          []nbdns.SimpleRecord{record},
-				NonAuthoritative: true,
-			}},
-			queryName:         "existing.custom.zone.",
-			expectFallthrough: false,
-			expectRecord:      true,
-		},
-		{
-			name: "Record found in authoritative zone returns normally",
-			zones: []nbdns.CustomZone{{
-				Domain:  "custom.zone.",
-				Records: []nbdns.SimpleRecord{record},
-			}},
-			queryName:         "existing.custom.zone.",
-			expectFallthrough: false,
-			expectRecord:      true,
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			resolver.Update(tc.zones)
-
-			var responseMSG *dns.Msg
-			responseWriter := &test.MockResponseWriter{
-				WriteMsgFunc: func(m *dns.Msg) error {
-					responseMSG = m
-					return nil
-				},
-			}
-
-			msg := new(dns.Msg).SetQuestion(tc.queryName, dns.TypeA)
-			resolver.ServeDNS(responseWriter, msg)
-
-			require.NotNil(t, responseMSG, "Should have received a response")
-
-			if tc.expectFallthrough {
-				assert.True(t, responseMSG.MsgHdr.Zero, "Zero bit should be set for fallthrough")
-				assert.Equal(t, dns.RcodeNameError, responseMSG.Rcode, "Should return NXDOMAIN")
-			} else {
-				assert.False(t, responseMSG.MsgHdr.Zero, "Zero bit should not be set")
-			}
-
-			if tc.expectRecord {
-				assert.Greater(t, len(responseMSG.Answer), 0, "Should have answer records")
-				assert.Equal(t, dns.RcodeSuccess, responseMSG.Rcode)
-			}
-		})
-	}
-}
-
-// TestLocalResolver_AuthoritativeFlag tests the AA flag behavior
-func TestLocalResolver_AuthoritativeFlag(t *testing.T) {
-	t.Run("direct record lookup is authoritative", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "example.com.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "host.example.com.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
-			},
-		}})
-
-		msg := new(dns.Msg).SetQuestion("host.example.com.", dns.TypeA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		assert.True(t, resp.Authoritative)
-	})
-
-	t.Run("external resolution is not authoritative", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.resolver = &mockResolver{
-			lookupFunc: func(_ context.Context, network, host string) ([]netip.Addr, error) {
-				if host == "external.example.com." && network == "ip4" {
-					return []netip.Addr{netip.MustParseAddr("93.184.216.34")}, nil
-				}
-				return nil, nil
-			},
-		}
-
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "test.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "alias.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.example.com."},
-			},
-		}})
-
-		msg := new(dns.Msg).SetQuestion("alias.test.", dns.TypeA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		require.Len(t, resp.Answer, 2)
-		assert.False(t, resp.Authoritative)
-	})
-}
-
-// TestLocalResolver_Stop tests cleanup on Stop
-func TestLocalResolver_Stop(t *testing.T) {
-	t.Run("Stop clears all state", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "example.com.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "host.example.com.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
-			},
-		}})
-
-		resolver.Stop()
-
-		msg := new(dns.Msg).SetQuestion("host.example.com.", dns.TypeA)
-		var resp *dns.Msg
-		resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}, msg)
-
-		require.NotNil(t, resp)
-		assert.Len(t, resp.Answer, 0)
-		assert.False(t, resolver.isInManagedZone("host.example.com."))
-	})
-
-	t.Run("Stop is safe to call multiple times", func(t *testing.T) {
-		resolver := NewResolver()
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "example.com.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "host.example.com.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
-			},
-		}})
-
-		resolver.Stop()
-		resolver.Stop()
-		resolver.Stop()
-	})
-
-	t.Run("Stop cancels in-flight external resolution", func(t *testing.T) {
-		resolver := NewResolver()
-
-		lookupStarted := make(chan struct{})
-		lookupCtxCanceled := make(chan struct{})
-
-		resolver.resolver = &mockResolver{
-			lookupFunc: func(ctx context.Context, network, host string) ([]netip.Addr, error) {
-				close(lookupStarted)
-				<-ctx.Done()
-				close(lookupCtxCanceled)
-				return nil, ctx.Err()
-			},
-		}
-
-		resolver.Update([]nbdns.CustomZone{{
-			Domain: "test.",
-			Records: []nbdns.SimpleRecord{
-				{Name: "alias.test.", Type: int(dns.TypeCNAME), Class: nbdns.DefaultClass, TTL: 300, RData: "external.example.com."},
-			},
-		}})
-
-		done := make(chan struct{})
-		go func() {
-			msg := new(dns.Msg).SetQuestion("alias.test.", dns.TypeA)
-			resolver.ServeDNS(&test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { return nil }}, msg)
-			close(done)
-		}()
-
-		<-lookupStarted
-		resolver.Stop()
-
-		select {
-		case <-lookupCtxCanceled:
-		case <-time.After(time.Second):
-			t.Fatal("external lookup context was not canceled")
-		}
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Fatal("ServeDNS did not return after Stop")
-		}
-	})
-}
-
-// TestLocalResolver_FallthroughCaseInsensitive verifies case-insensitive domain matching for fallthrough
-func TestLocalResolver_FallthroughCaseInsensitive(t *testing.T) {
-	resolver := NewResolver()
-
-	resolver.Update([]nbdns.CustomZone{{
-		Domain:           "EXAMPLE.COM.",
-		Records:          []nbdns.SimpleRecord{{Name: "host.example.com.", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "1.2.3.4"}},
-		NonAuthoritative: true,
-	}})
-
-	var responseMSG *dns.Msg
-	responseWriter := &test.MockResponseWriter{
-		WriteMsgFunc: func(m *dns.Msg) error {
-			responseMSG = m
-			return nil
-		},
-	}
-
-	msg := new(dns.Msg).SetQuestion("nonexistent.example.com.", dns.TypeA)
-	resolver.ServeDNS(responseWriter, msg)
-
-	require.NotNil(t, responseMSG)
-	assert.True(t, responseMSG.MsgHdr.Zero, "Should fallthrough for non-authoritative zone with case-insensitive match")
-}
-
-// BenchmarkFindZone_BestCase benchmarks zone lookup with immediate match (first label)
-func BenchmarkFindZone_BestCase(b *testing.B) {
-	resolver := NewResolver()
-
-	// Single zone that matches immediately
-	resolver.Update([]nbdns.CustomZone{{
-		Domain:           "example.com.",
-		NonAuthoritative: true,
-	}})
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		resolver.shouldFallthrough("example.com.")
-	}
-}
-
-// BenchmarkFindZone_WorstCase benchmarks zone lookup with many zones, no match, many labels
-func BenchmarkFindZone_WorstCase(b *testing.B) {
-	resolver := NewResolver()
-
-	// 100 zones that won't match
-	var zones []nbdns.CustomZone
-	for i := 0; i < 100; i++ {
-		zones = append(zones, nbdns.CustomZone{
-			Domain:           fmt.Sprintf("zone%d.internal.", i),
-			NonAuthoritative: true,
-		})
-	}
-	resolver.Update(zones)
-
-	// Query with many labels that won't match any zone
-	qname := "a.b.c.d.e.f.g.h.external.com."
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		resolver.shouldFallthrough(qname)
-	}
-}
-
-// BenchmarkFindZone_TypicalCase benchmarks typical usage: few zones, subdomain match
-func BenchmarkFindZone_TypicalCase(b *testing.B) {
-	resolver := NewResolver()
-
-	// Typical setup: peer zone (authoritative) + one user zone (non-authoritative)
-	resolver.Update([]nbdns.CustomZone{
-		{Domain: "netbird.cloud.", NonAuthoritative: false},
-		{Domain: "custom.local.", NonAuthoritative: true},
-	})
-
-	// Query for subdomain of user zone
-	qname := "myhost.custom.local."
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		resolver.shouldFallthrough(qname)
-	}
-}
-
-// BenchmarkIsInManagedZone_ManyZones benchmarks isInManagedZone with 100 zones
-func BenchmarkIsInManagedZone_ManyZones(b *testing.B) {
-	resolver := NewResolver()
-
-	var zones []nbdns.CustomZone
-	for i := 0; i < 100; i++ {
-		zones = append(zones, nbdns.CustomZone{
-			Domain: fmt.Sprintf("zone%d.internal.", i),
-		})
-	}
-	resolver.Update(zones)
-
-	// Query that matches zone50
-	qname := "host.zone50.internal."
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		resolver.isInManagedZone(qname)
-	}
-}

client/internal/dns/resutil/resolve.go

@@ -1,197 +0,0 @@
-// Package resutil provides shared DNS resolution utilities
-package resutil
-
-import (
-	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"errors"
-	"net"
-	"net/netip"
-	"strings"
-
-	"github.com/miekg/dns"
-	log "github.com/sirupsen/logrus"
-)
-
-// GenerateRequestID creates a random 8-character hex string for request tracing.
-func GenerateRequestID() string {
-	bytes := make([]byte, 4)
-	if _, err := rand.Read(bytes); err != nil {
-		log.Errorf("generate request ID: %v", err)
-		return ""
-	}
-	return hex.EncodeToString(bytes)
-}
-
-// IPsToRRs converts a slice of IP addresses to DNS resource records.
-// IPv4 addresses become A records, IPv6 addresses become AAAA records.
-func IPsToRRs(name string, ips []netip.Addr, ttl uint32) []dns.RR {
-	var result []dns.RR
-
-	for _, ip := range ips {
-		if ip.Is6() {
-			result = append(result, &dns.AAAA{
-				Hdr: dns.RR_Header{
-					Name:   name,
-					Rrtype: dns.TypeAAAA,
-					Class:  dns.ClassINET,
-					Ttl:    ttl,
-				},
-				AAAA: ip.AsSlice(),
-			})
-		} else {
-			result = append(result, &dns.A{
-				Hdr: dns.RR_Header{
-					Name:   name,
-					Rrtype: dns.TypeA,
-					Class:  dns.ClassINET,
-					Ttl:    ttl,
-				},
-				A: ip.AsSlice(),
-			})
-		}
-	}
-
-	return result
-}
-
-// NetworkForQtype returns the network string ("ip4" or "ip6") for a DNS query type.
-// Returns empty string for unsupported types.
-func NetworkForQtype(qtype uint16) string {
-	switch qtype {
-	case dns.TypeA:
-		return "ip4"
-	case dns.TypeAAAA:
-		return "ip6"
-	default:
-		return ""
-	}
-}
-
-type resolver interface {
-	LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
-}
-
-// chainedWriter is implemented by ResponseWriters that carry request metadata
-type chainedWriter interface {
-	RequestID() string
-	SetMeta(key, value string)
-}
-
-// GetRequestID extracts a request ID from the ResponseWriter if available,
-// otherwise generates a new one.
-func GetRequestID(w dns.ResponseWriter) string {
-	if cw, ok := w.(chainedWriter); ok {
-		if id := cw.RequestID(); id != "" {
-			return id
-		}
-	}
-	return GenerateRequestID()
-}
-
-// SetMeta sets metadata on the ResponseWriter if it supports it.
-func SetMeta(w dns.ResponseWriter, key, value string) {
-	if cw, ok := w.(chainedWriter); ok {
-		cw.SetMeta(key, value)
-	}
-}
-
-// LookupResult contains the result of an external DNS lookup
-type LookupResult struct {
-	IPs   []netip.Addr
-	Rcode int
-	Err   error // Original error for caller's logging needs
-}
-
-// LookupIP performs a DNS lookup and determines the appropriate rcode.
-func LookupIP(ctx context.Context, r resolver, network, host string, qtype uint16) LookupResult {
-	ips, err := r.LookupNetIP(ctx, network, host)
-	if err != nil {
-		return LookupResult{
-			Rcode: getRcodeForError(ctx, r, host, qtype, err),
-			Err:   err,
-		}
-	}
-
-	// Unmap IPv4-mapped IPv6 addresses that some resolvers may return
-	for i, ip := range ips {
-		ips[i] = ip.Unmap()
-	}
-
-	return LookupResult{
-		IPs:   ips,
-		Rcode: dns.RcodeSuccess,
-	}
-}
-
-func getRcodeForError(ctx context.Context, r resolver, host string, qtype uint16, err error) int {
-	var dnsErr *net.DNSError
-	if !errors.As(err, &dnsErr) {
-		return dns.RcodeServerFailure
-	}
-
-	if dnsErr.IsNotFound {
-		return getRcodeForNotFound(ctx, r, host, qtype)
-	}
-
-	return dns.RcodeServerFailure
-}
-
-// getRcodeForNotFound distinguishes between NXDOMAIN (domain doesn't exist) and NODATA
-// (domain exists but no records of requested type) by checking the opposite record type.
-//
-// musl libc (the reason we need this distinction) only queries A/AAAA pairs in getaddrinfo,
-// so checking the opposite A/AAAA type is sufficient. Other record types (MX, TXT, etc.)
-// are not queried by musl and don't need this handling.
-func getRcodeForNotFound(ctx context.Context, r resolver, domain string, originalQtype uint16) int {
-	// Try querying for a different record type to see if the domain exists
-	// If the original query was for AAAA, try A. If it was for A, try AAAA.
-	// This helps distinguish between NXDOMAIN and NODATA.
-	var alternativeNetwork string
-	switch originalQtype {
-	case dns.TypeAAAA:
-		alternativeNetwork = "ip4"
-	case dns.TypeA:
-		alternativeNetwork = "ip6"
-	default:
-		return dns.RcodeNameError
-	}
-
-	if _, err := r.LookupNetIP(ctx, alternativeNetwork, domain); err != nil {
-		var dnsErr *net.DNSError
-		if errors.As(err, &dnsErr) && dnsErr.IsNotFound {
-			// Alternative query also returned not found - domain truly doesn't exist
-			return dns.RcodeNameError
-		}
-		// Some other error (timeout, server failure, etc.) - can't determine, assume domain exists
-		return dns.RcodeSuccess
-	}
-
-	// Alternative query succeeded - domain exists but has no records of this type
-	return dns.RcodeSuccess
-}
-
-// FormatAnswers formats DNS resource records for logging.
-func FormatAnswers(answers []dns.RR) string {
-	if len(answers) == 0 {
-		return "[]"
-	}
-
-	parts := make([]string, 0, len(answers))
-	for _, rr := range answers {
-		switch r := rr.(type) {
-		case *dns.A:
-			parts = append(parts, r.A.String())
-		case *dns.AAAA:
-			parts = append(parts, r.AAAA.String())
-		case *dns.CNAME:
-			parts = append(parts, "CNAME:"+r.Target)
-		case *dns.PTR:
-			parts = append(parts, "PTR:"+r.Ptr)
-		default:
-			parts = append(parts, dns.TypeToString[rr.Header().Rrtype])
-		}
-	}
-	return "[" + strings.Join(parts, ", ") + "]"
-}

client/internal/dns/server.go

@@ -485,7 +485,7 @@ func (s *DefaultServer) applyConfiguration(update nbdns.Config) error {
 		}
 	}
 
-	localMuxUpdates, localZones, err := s.buildLocalHandlerUpdate(update.CustomZones)
+	localMuxUpdates, localRecords, err := s.buildLocalHandlerUpdate(update.CustomZones)
 	if err != nil {
 		return fmt.Errorf("local handler updater: %w", err)
 	}
@@ -498,7 +498,8 @@ func (s *DefaultServer) applyConfiguration(update nbdns.Config) error {
 
 	s.updateMux(muxUpdates)
 
-	s.localResolver.Update(localZones)
+	// register local records
+	s.localResolver.Update(localRecords)
 
 	s.currentConfig = dnsConfigToHostDNSConfig(update, s.service.RuntimeIP(), s.service.RuntimePort())
 
@@ -658,9 +659,9 @@ func (s *DefaultServer) registerFallback(config HostDNSConfig) {
 	s.registerHandler([]string{nbdns.RootZone}, handler, PriorityFallback)
 }
 
-func (s *DefaultServer) buildLocalHandlerUpdate(customZones []nbdns.CustomZone) ([]handlerWrapper, []nbdns.CustomZone, error) {
+func (s *DefaultServer) buildLocalHandlerUpdate(customZones []nbdns.CustomZone) ([]handlerWrapper, []nbdns.SimpleRecord, error) {
 	var muxUpdates []handlerWrapper
-	var zones []nbdns.CustomZone
+	var localRecords []nbdns.SimpleRecord
 
 	for _, customZone := range customZones {
 		if len(customZone.Records) == 0 {
@@ -674,20 +675,17 @@ func (s *DefaultServer) buildLocalHandlerUpdate(customZones []nbdns.CustomZone)
 			priority: PriorityLocal,
 		})
 
-		// zone records contain the fqdn, so we can just flatten them
-		var localRecords []nbdns.SimpleRecord
 		for _, record := range customZone.Records {
 			if record.Class != nbdns.DefaultClass {
 				log.Warnf("received an invalid class type: %s", record.Class)
 				continue
 			}
+			// zone records contain the fqdn, so we can just flatten them
 			localRecords = append(localRecords, record)
 		}
-		customZone.Records = localRecords
-		zones = append(zones, customZone)
 	}
 
-	return muxUpdates, zones, nil
+	return muxUpdates, localRecords, nil
 }
 
 func (s *DefaultServer) buildUpstreamHandlerUpdate(nameServerGroups []*nbdns.NameServerGroup) ([]handlerWrapper, error) {

client/internal/dns/server_test.go

@@ -128,7 +128,7 @@ func TestUpdateDNSServer(t *testing.T) {
 	testCases := []struct {
 		name                string
 		initUpstreamMap     registeredHandlerMap
-		initLocalZones      []nbdns.CustomZone
+		initLocalRecords    []nbdns.SimpleRecord
 		initSerial          uint64
 		inputSerial         uint64
 		inputUpdate         nbdns.Config
@@ -181,7 +181,7 @@ func TestUpdateDNSServer(t *testing.T) {
 		},
 		{
 			name:             "New Config Should Succeed",
-			initLocalZones: []nbdns.CustomZone{{Domain: "netbird.cloud", Records: []nbdns.SimpleRecord{{Name: "netbird.cloud", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}}}},
+			initLocalRecords: []nbdns.SimpleRecord{{Name: "netbird.cloud", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}},
 			initUpstreamMap: registeredHandlerMap{
 				generateDummyHandler(zoneRecords[0].Name, nameServers).ID(): handlerWrapper{
 					domain:   "netbird.cloud",
@@ -222,7 +222,7 @@ func TestUpdateDNSServer(t *testing.T) {
 		},
 		{
 			name:             "Smaller Config Serial Should Be Skipped",
-			initLocalZones: []nbdns.CustomZone{},
+			initLocalRecords: []nbdns.SimpleRecord{},
 			initUpstreamMap:  make(registeredHandlerMap),
 			initSerial:       2,
 			inputSerial:      1,
@@ -230,7 +230,7 @@ func TestUpdateDNSServer(t *testing.T) {
 		},
 		{
 			name:             "Empty NS Group Domain Or Not Primary Element Should Fail",
-			initLocalZones: []nbdns.CustomZone{},
+			initLocalRecords: []nbdns.SimpleRecord{},
 			initUpstreamMap:  make(registeredHandlerMap),
 			initSerial:       0,
 			inputSerial:      1,
@@ -252,7 +252,7 @@ func TestUpdateDNSServer(t *testing.T) {
 		},
 		{
 			name:             "Invalid NS Group Nameservers list Should Fail",
-			initLocalZones: []nbdns.CustomZone{},
+			initLocalRecords: []nbdns.SimpleRecord{},
 			initUpstreamMap:  make(registeredHandlerMap),
 			initSerial:       0,
 			inputSerial:      1,
@@ -274,7 +274,7 @@ func TestUpdateDNSServer(t *testing.T) {
 		},
 		{
 			name:             "Invalid Custom Zone Records list Should Skip",
-			initLocalZones: []nbdns.CustomZone{},
+			initLocalRecords: []nbdns.SimpleRecord{},
 			initUpstreamMap:  make(registeredHandlerMap),
 			initSerial:       0,
 			inputSerial:      1,
@@ -300,7 +300,7 @@ func TestUpdateDNSServer(t *testing.T) {
 		},
 		{
 			name:             "Empty Config Should Succeed and Clean Maps",
-			initLocalZones: []nbdns.CustomZone{{Domain: "netbird.cloud", Records: []nbdns.SimpleRecord{{Name: "netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}}}},
+			initLocalRecords: []nbdns.SimpleRecord{{Name: "netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}},
 			initUpstreamMap: registeredHandlerMap{
 				generateDummyHandler(zoneRecords[0].Name, nameServers).ID(): handlerWrapper{
 					domain:   zoneRecords[0].Name,
@@ -316,7 +316,7 @@ func TestUpdateDNSServer(t *testing.T) {
 		},
 		{
 			name:             "Disabled Service Should clean map",
-			initLocalZones: []nbdns.CustomZone{{Domain: "netbird.cloud", Records: []nbdns.SimpleRecord{{Name: "netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}}}},
+			initLocalRecords: []nbdns.SimpleRecord{{Name: "netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}},
 			initUpstreamMap: registeredHandlerMap{
 				generateDummyHandler(zoneRecords[0].Name, nameServers).ID(): handlerWrapper{
 					domain:   zoneRecords[0].Name,
@@ -385,7 +385,7 @@ func TestUpdateDNSServer(t *testing.T) {
 			}()
 
 			dnsServer.dnsMuxMap = testCase.initUpstreamMap
-			dnsServer.localResolver.Update(testCase.initLocalZones)
+			dnsServer.localResolver.Update(testCase.initLocalRecords)
 			dnsServer.updateSerial = testCase.initSerial
 
 			err = dnsServer.UpdateDNSServer(testCase.inputSerial, testCase.inputUpdate)
@@ -510,7 +510,8 @@ func TestDNSFakeResolverHandleUpdates(t *testing.T) {
 			priority: PriorityUpstream,
 		},
 	}
-	dnsServer.localResolver.Update([]nbdns.CustomZone{{Domain: "netbird.cloud", Records: []nbdns.SimpleRecord{{Name: "netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}}}})
+	//dnsServer.localResolver.RegisteredMap = local.RegistrationMap{local.BuildRecordKey("netbird.cloud", dns.ClassINET, dns.TypeA): struct{}{}}
+	dnsServer.localResolver.Update([]nbdns.SimpleRecord{{Name: "netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"}})
 	dnsServer.updateSerial = 0
 
 	nameServers := []nbdns.NameServer{

client/internal/dns/upstream.go

@@ -2,6 +2,7 @@ package dns
 
 import (
 	"context"
+	"crypto/rand"
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
@@ -20,7 +21,6 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/dns/types"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/proto"
@@ -113,7 +113,10 @@ func (u *upstreamResolverBase) Stop() {
 
 // ServeDNS handles a DNS request
 func (u *upstreamResolverBase) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
-	logger := log.WithField("request_id", resutil.GetRequestID(w))
+	requestID := GenerateRequestID()
+	logger := log.WithField("request_id", requestID)
+
+	logger.Tracef("received upstream question: domain=%s type=%v class=%v", r.Question[0].Name, r.Question[0].Qtype, r.Question[0].Qclass)
 
 	u.prepareRequest(r)
 
@@ -199,18 +202,11 @@ func (u *upstreamResolverBase) handleUpstreamError(err error, upstream netip.Add
 
 func (u *upstreamResolverBase) writeSuccessResponse(w dns.ResponseWriter, rm *dns.Msg, upstream netip.AddrPort, domain string, t time.Duration, logger *log.Entry) bool {
 	u.successCount.Add(1)
-
-	resutil.SetMeta(w, "upstream", upstream.String())
-
-	// Clear Zero bit from external responses to prevent upstream servers from
-	// manipulating our internal fallthrough signaling mechanism
-	rm.MsgHdr.Zero = false
+	logger.Tracef("took %s to query the upstream %s for question domain=%s", t, upstream, domain)
 
 	if err := w.WriteMsg(rm); err != nil {
 		logger.Errorf("failed to write DNS response for question domain=%s: %s", domain, err)
-		return true
 	}
-
 	return true
 }
 
@@ -418,6 +414,16 @@ func ExchangeWithFallback(ctx context.Context, client *dns.Client, r *dns.Msg, u
 	return rm, t, nil
 }
 
+func GenerateRequestID() string {
+	bytes := make([]byte, 4)
+	_, err := rand.Read(bytes)
+	if err != nil {
+		log.Errorf("failed to generate request ID: %v", err)
+		return ""
+	}
+	return hex.EncodeToString(bytes)
+}
+
 // FormatPeerStatus formats peer connection status information for debugging DNS timeouts
 func FormatPeerStatus(peerState *peer.State) string {
 	isConnected := peerState.ConnStatus == peer.StatusConnected

client/internal/dnsfwd/forwarder.go

@@ -18,7 +18,6 @@ import (
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/route"
 )
@@ -190,22 +189,29 @@ func (f *DNSForwarder) Close(ctx context.Context) error {
 	return nberrors.FormatErrorOrNil(result)
 }
 
-func (f *DNSForwarder) handleDNSQuery(logger *log.Entry, w dns.ResponseWriter, query *dns.Msg) *dns.Msg {
+func (f *DNSForwarder) handleDNSQuery(w dns.ResponseWriter, query *dns.Msg) *dns.Msg {
 	if len(query.Question) == 0 {
 		return nil
 	}
 	question := query.Question[0]
-	logger.Tracef("received DNS request for DNS forwarder: domain=%s type=%s class=%s",
-		question.Name, dns.TypeToString[question.Qtype], dns.ClassToString[question.Qclass])
+	log.Tracef("received DNS request for DNS forwarder: domain=%v type=%v class=%v",
+		question.Name, question.Qtype, question.Qclass)
 
 	domain := strings.ToLower(question.Name)
 
 	resp := query.SetReply(query)
-	network := resutil.NetworkForQtype(question.Qtype)
-	if network == "" {
+	var network string
+	switch question.Qtype {
+	case dns.TypeA:
+		network = "ip4"
+	case dns.TypeAAAA:
+		network = "ip6"
+	default:
+		// TODO: Handle other types
+
 		resp.Rcode = dns.RcodeNotImplemented
 		if err := w.WriteMsg(resp); err != nil {
-			logger.Errorf("failed to write DNS response: %v", err)
+			log.Errorf("failed to write DNS response: %v", err)
 		}
 		return nil
 	}
@@ -215,35 +221,33 @@ func (f *DNSForwarder) handleDNSQuery(logger *log.Entry, w dns.ResponseWriter, q
 	if mostSpecificResId == "" {
 		resp.Rcode = dns.RcodeRefused
 		if err := w.WriteMsg(resp); err != nil {
-			logger.Errorf("failed to write DNS response: %v", err)
+			log.Errorf("failed to write DNS response: %v", err)
 		}
 		return nil
 	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), upstreamTimeout)
 	defer cancel()
-
-	result := resutil.LookupIP(ctx, f.resolver, network, domain, question.Qtype)
-	if result.Err != nil {
-		f.handleDNSError(ctx, logger, w, question, resp, domain, result)
+	ips, err := f.resolver.LookupNetIP(ctx, network, domain)
+	if err != nil {
+		f.handleDNSError(ctx, w, question, resp, domain, err)
 		return nil
 	}
 
-	f.updateInternalState(result.IPs, mostSpecificResId, matchingEntries)
-	resp.Answer = append(resp.Answer, resutil.IPsToRRs(domain, result.IPs, f.ttl)...)
-	f.cache.set(domain, question.Qtype, result.IPs)
+	// Unmap IPv4-mapped IPv6 addresses that some resolvers may return
+	for i, ip := range ips {
+		ips[i] = ip.Unmap()
+	}
+
+	f.updateInternalState(ips, mostSpecificResId, matchingEntries)
+	f.addIPsToResponse(resp, domain, ips)
+	f.cache.set(domain, question.Qtype, ips)
 
 	return resp
 }
 
 func (f *DNSForwarder) handleDNSQueryUDP(w dns.ResponseWriter, query *dns.Msg) {
-	startTime := time.Now()
-	logger := log.WithFields(log.Fields{
-		"request_id": resutil.GenerateRequestID(),
-		"dns_id":     fmt.Sprintf("%04x", query.Id),
-	})
-
-	resp := f.handleDNSQuery(logger, w, query)
+	resp := f.handleDNSQuery(w, query)
 	if resp == nil {
 		return
 	}
@@ -261,33 +265,19 @@ func (f *DNSForwarder) handleDNSQueryUDP(w dns.ResponseWriter, query *dns.Msg) {
 	}
 
 	if err := w.WriteMsg(resp); err != nil {
-		logger.Errorf("failed to write DNS response: %v", err)
-		return
+		log.Errorf("failed to write DNS response: %v", err)
 	}
-
-	logger.Tracef("response: domain=%s rcode=%s answers=%s took=%s",
-		query.Question[0].Name, dns.RcodeToString[resp.Rcode], resutil.FormatAnswers(resp.Answer), time.Since(startTime))
 }
 
 func (f *DNSForwarder) handleDNSQueryTCP(w dns.ResponseWriter, query *dns.Msg) {
-	startTime := time.Now()
-	logger := log.WithFields(log.Fields{
-		"request_id": resutil.GenerateRequestID(),
-		"dns_id":     fmt.Sprintf("%04x", query.Id),
-	})
-
-	resp := f.handleDNSQuery(logger, w, query)
+	resp := f.handleDNSQuery(w, query)
 	if resp == nil {
 		return
 	}
 
 	if err := w.WriteMsg(resp); err != nil {
-		logger.Errorf("failed to write DNS response: %v", err)
-		return
+		log.Errorf("failed to write DNS response: %v", err)
 	}
-
-	logger.Tracef("response: domain=%s rcode=%s answers=%s took=%s",
-		query.Question[0].Name, dns.RcodeToString[resp.Rcode], resutil.FormatAnswers(resp.Answer), time.Since(startTime))
 }
 
 func (f *DNSForwarder) updateInternalState(ips []netip.Addr, mostSpecificResId route.ResID, matchingEntries []*ForwarderEntry) {
@@ -325,64 +315,140 @@ func (f *DNSForwarder) updateFirewall(matchingEntries []*ForwarderEntry, prefixe
 	}
 }
 
+// setResponseCodeForNotFound determines and sets the appropriate response code when IsNotFound is true
+// It distinguishes between NXDOMAIN (domain doesn't exist) and NODATA (domain exists but no records of requested type)
+//
+// LIMITATION: This function only checks A and AAAA record types to determine domain existence.
+// If a domain has only other record types (MX, TXT, CNAME, etc.) but no A/AAAA records,
+// it may incorrectly return NXDOMAIN instead of NODATA. This is acceptable since the forwarder
+// only handles A/AAAA queries and returns NOTIMP for other types.
+func (f *DNSForwarder) setResponseCodeForNotFound(ctx context.Context, resp *dns.Msg, domain string, originalQtype uint16) {
+	// Try querying for a different record type to see if the domain exists
+	// If the original query was for AAAA, try A. If it was for A, try AAAA.
+	// This helps distinguish between NXDOMAIN and NODATA.
+	var alternativeNetwork string
+	switch originalQtype {
+	case dns.TypeAAAA:
+		alternativeNetwork = "ip4"
+	case dns.TypeA:
+		alternativeNetwork = "ip6"
+	default:
+		resp.Rcode = dns.RcodeNameError
+		return
+	}
+
+	if _, err := f.resolver.LookupNetIP(ctx, alternativeNetwork, domain); err != nil {
+		var dnsErr *net.DNSError
+		if errors.As(err, &dnsErr) && dnsErr.IsNotFound {
+			// Alternative query also returned not found - domain truly doesn't exist
+			resp.Rcode = dns.RcodeNameError
+			return
+		}
+		// Some other error (timeout, server failure, etc.) - can't determine, assume domain exists
+		resp.Rcode = dns.RcodeSuccess
+		return
+	}
+
+	// Alternative query succeeded - domain exists but has no records of this type
+	resp.Rcode = dns.RcodeSuccess
+}
+
 // handleDNSError processes DNS lookup errors and sends an appropriate error response.
 func (f *DNSForwarder) handleDNSError(
 	ctx context.Context,
-	logger *log.Entry,
 	w dns.ResponseWriter,
 	question dns.Question,
 	resp *dns.Msg,
 	domain string,
-	result resutil.LookupResult,
+	err error,
 ) {
+	// Default to SERVFAIL; override below when appropriate.
+	resp.Rcode = dns.RcodeServerFailure
+
 	qType := question.Qtype
 	qTypeName := dns.TypeToString[qType]
 
-	resp.Rcode = result.Rcode
-
-	// NotFound: cache negative result and respond
-	if result.Rcode == dns.RcodeNameError || result.Rcode == dns.RcodeSuccess {
-		f.cache.set(domain, question.Qtype, nil)
+	// Prefer typed DNS errors; fall back to generic logging otherwise.
+	var dnsErr *net.DNSError
+	if !errors.As(err, &dnsErr) {
+		log.Warnf(errResolveFailed, domain, err)
 		if writeErr := w.WriteMsg(resp); writeErr != nil {
-			logger.Errorf("failed to write failure DNS response: %v", writeErr)
+			log.Errorf("failed to write failure DNS response: %v", writeErr)
 		}
 		return
 	}
 
+	// NotFound: set NXDOMAIN / appropriate code via helper.
+	if dnsErr.IsNotFound {
+		f.setResponseCodeForNotFound(ctx, resp, domain, qType)
+		if writeErr := w.WriteMsg(resp); writeErr != nil {
+			log.Errorf("failed to write failure DNS response: %v", writeErr)
+		}
+		f.cache.set(domain, question.Qtype, nil)
+		return
+	}
+
 	// Upstream failed but we might have a cached answer—serve it if present.
 	if ips, ok := f.cache.get(domain, qType); ok {
 		if len(ips) > 0 {
-			logger.Debugf("serving cached DNS response after upstream failure: domain=%s type=%s", domain, qTypeName)
-			resp.Answer = append(resp.Answer, resutil.IPsToRRs(domain, ips, f.ttl)...)
+			log.Debugf("serving cached DNS response after upstream failure: domain=%s type=%s", domain, qTypeName)
+			f.addIPsToResponse(resp, domain, ips)
 			resp.Rcode = dns.RcodeSuccess
 			if writeErr := w.WriteMsg(resp); writeErr != nil {
-				logger.Errorf("failed to write cached DNS response: %v", writeErr)
+				log.Errorf("failed to write cached DNS response: %v", writeErr)
 			}
-			return
-		}
-
-		// Cached negative result - re-verify NXDOMAIN vs NODATA
-		verifyResult := resutil.LookupIP(ctx, f.resolver, resutil.NetworkForQtype(qType), domain, qType)
-		if verifyResult.Rcode == dns.RcodeNameError || verifyResult.Rcode == dns.RcodeSuccess {
-			resp.Rcode = verifyResult.Rcode
+		} else { // send NXDOMAIN / appropriate code if cache is empty
+			f.setResponseCodeForNotFound(ctx, resp, domain, qType)
 			if writeErr := w.WriteMsg(resp); writeErr != nil {
-				logger.Errorf("failed to write failure DNS response: %v", writeErr)
+				log.Errorf("failed to write failure DNS response: %v", writeErr)
 			}
-			return
 		}
+		return
 	}
 
-	// No cache or verification failed. Log with or without the server field for more context.
-	var dnsErr *net.DNSError
-	if errors.As(result.Err, &dnsErr) && dnsErr.Server != "" {
-		logger.Warnf("failed to resolve: type=%s domain=%s server=%s: %v", qTypeName, domain, dnsErr.Server, result.Err)
+	// No cache. Log with or without the server field for more context.
+	if dnsErr.Server != "" {
+		log.Warnf("failed to resolve: type=%s domain=%s server=%s: %v", qTypeName, domain, dnsErr.Server, err)
 	} else {
-		logger.Warnf(errResolveFailed, domain, result.Err)
+		log.Warnf(errResolveFailed, domain, err)
 	}
 
 	// Write final failure response.
 	if writeErr := w.WriteMsg(resp); writeErr != nil {
-		logger.Errorf("failed to write failure DNS response: %v", writeErr)
+		log.Errorf("failed to write failure DNS response: %v", writeErr)
+	}
+}
+
+// addIPsToResponse adds IP addresses to the DNS response as appropriate A or AAAA records
+func (f *DNSForwarder) addIPsToResponse(resp *dns.Msg, domain string, ips []netip.Addr) {
+	for _, ip := range ips {
+		var respRecord dns.RR
+		if ip.Is6() {
+			log.Tracef("resolved domain=%s to IPv6=%s", domain, ip)
+			rr := dns.AAAA{
+				AAAA: ip.AsSlice(),
+				Hdr: dns.RR_Header{
+					Name:   domain,
+					Rrtype: dns.TypeAAAA,
+					Class:  dns.ClassINET,
+					Ttl:    f.ttl,
+				},
+			}
+			respRecord = &rr
+		} else {
+			log.Tracef("resolved domain=%s to IPv4=%s", domain, ip)
+			rr := dns.A{
+				A: ip.AsSlice(),
+				Hdr: dns.RR_Header{
+					Name:   domain,
+					Rrtype: dns.TypeA,
+					Class:  dns.ClassINET,
+					Ttl:    f.ttl,
+				},
+			}
+			respRecord = &rr
+		}
+		resp.Answer = append(resp.Answer, respRecord)
 	}
 }
 

client/internal/dnsfwd/forwarder_test.go

@@ -10,7 +10,6 @@ import (
 	"time"
 
 	"github.com/miekg/dns"
-	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
@@ -318,7 +317,7 @@ func TestDNSForwarder_UnauthorizedDomainAccess(t *testing.T) {
 			query.SetQuestion(dns.Fqdn(tt.queryDomain), dns.TypeA)
 
 			mockWriter := &test.MockResponseWriter{}
-			resp := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, query)
+			resp := forwarder.handleDNSQuery(mockWriter, query)
 
 			if tt.shouldResolve {
 				require.NotNil(t, resp, "Expected response for authorized domain")
@@ -466,7 +465,7 @@ func TestDNSForwarder_FirewallSetUpdates(t *testing.T) {
 			dnsQuery.SetQuestion(dns.Fqdn(tt.query), dns.TypeA)
 
 			mockWriter := &test.MockResponseWriter{}
-			resp := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, dnsQuery)
+			resp := forwarder.handleDNSQuery(mockWriter, dnsQuery)
 
 			// Verify response
 			if tt.shouldResolve {
@@ -528,7 +527,7 @@ func TestDNSForwarder_MultipleIPsInSingleUpdate(t *testing.T) {
 	query.SetQuestion("example.com.", dns.TypeA)
 
 	mockWriter := &test.MockResponseWriter{}
-	resp := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, query)
+	resp := forwarder.handleDNSQuery(mockWriter, query)
 
 	// Verify response contains all IPs
 	require.NotNil(t, resp)
@@ -605,7 +604,7 @@ func TestDNSForwarder_ResponseCodes(t *testing.T) {
 				},
 			}
 
-			_ = forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, query)
+			_ = forwarder.handleDNSQuery(mockWriter, query)
 
 			// Check the response written to the writer
 			require.NotNil(t, writtenResp, "Expected response to be written")
@@ -675,7 +674,7 @@ func TestDNSForwarder_ServeFromCacheOnUpstreamFailure(t *testing.T) {
 	q1 := &dns.Msg{}
 	q1.SetQuestion(dns.Fqdn("example.com"), dns.TypeA)
 	w1 := &test.MockResponseWriter{}
-	resp1 := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), w1, q1)
+	resp1 := forwarder.handleDNSQuery(w1, q1)
 	require.NotNil(t, resp1)
 	require.Equal(t, dns.RcodeSuccess, resp1.Rcode)
 	require.Len(t, resp1.Answer, 1)
@@ -685,7 +684,7 @@ func TestDNSForwarder_ServeFromCacheOnUpstreamFailure(t *testing.T) {
 	q2.SetQuestion(dns.Fqdn("example.com"), dns.TypeA)
 	var writtenResp *dns.Msg
 	w2 := &test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { writtenResp = m; return nil }}
-	_ = forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), w2, q2)
+	_ = forwarder.handleDNSQuery(w2, q2)
 
 	require.NotNil(t, writtenResp, "expected response to be written")
 	require.Equal(t, dns.RcodeSuccess, writtenResp.Rcode)
@@ -715,7 +714,7 @@ func TestDNSForwarder_CacheNormalizationCasingAndDot(t *testing.T) {
 	q1 := &dns.Msg{}
 	q1.SetQuestion(mixedQuery+".", dns.TypeA)
 	w1 := &test.MockResponseWriter{}
-	resp1 := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), w1, q1)
+	resp1 := forwarder.handleDNSQuery(w1, q1)
 	require.NotNil(t, resp1)
 	require.Equal(t, dns.RcodeSuccess, resp1.Rcode)
 	require.Len(t, resp1.Answer, 1)
@@ -729,7 +728,7 @@ func TestDNSForwarder_CacheNormalizationCasingAndDot(t *testing.T) {
 	q2.SetQuestion("EXAMPLE.COM", dns.TypeA)
 	var writtenResp *dns.Msg
 	w2 := &test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { writtenResp = m; return nil }}
-	_ = forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), w2, q2)
+	_ = forwarder.handleDNSQuery(w2, q2)
 
 	require.NotNil(t, writtenResp)
 	require.Equal(t, dns.RcodeSuccess, writtenResp.Rcode)
@@ -784,7 +783,7 @@ func TestDNSForwarder_MultipleOverlappingPatterns(t *testing.T) {
 	query.SetQuestion("smtp.mail.example.com.", dns.TypeA)
 
 	mockWriter := &test.MockResponseWriter{}
-	resp := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, query)
+	resp := forwarder.handleDNSQuery(mockWriter, query)
 
 	require.NotNil(t, resp)
 	assert.Equal(t, dns.RcodeSuccess, resp.Rcode)
@@ -905,7 +904,7 @@ func TestDNSForwarder_NodataVsNxdomain(t *testing.T) {
 				},
 			}
 
-			resp := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, query)
+			resp := forwarder.handleDNSQuery(mockWriter, query)
 
 			// If a response was returned, it means it should be written (happens in wrapper functions)
 			if resp != nil && writtenResp == nil {
@@ -938,7 +937,7 @@ func TestDNSForwarder_EmptyQuery(t *testing.T) {
 			return nil
 		},
 	}
-	resp := forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, query)
+	resp := forwarder.handleDNSQuery(mockWriter, query)
 
 	assert.Nil(t, resp, "Should return nil for empty query")
 	assert.False(t, writeCalled, "Should not write response for empty query")

client/internal/engine.go

@@ -1251,16 +1251,11 @@ func toDNSConfig(protoDNSConfig *mgmProto.DNSConfig, network netip.Prefix) nbdns
 		ForwarderPort:    forwarderPort,
 	}
 
-	protoZones := protoDNSConfig.GetCustomZones()
-	// Treat single zone as authoritative for backward compatibility with old servers
-	// that only send the peer FQDN zone without setting field 4.
-	singleZoneCompat := len(protoZones) == 1
-
-	for _, zone := range protoZones {
+	for _, zone := range protoDNSConfig.GetCustomZones() {
 		dnsZone := nbdns.CustomZone{
 			Domain:               zone.GetDomain(),
 			SearchDomainDisabled: zone.GetSearchDomainDisabled(),
-			NonAuthoritative:     zone.GetNonAuthoritative() && !singleZoneCompat,
+			SkipPTRProcess:       zone.GetSkipPTRProcess(),
 		}
 		for _, record := range zone.Records {
 			dnsRecord := nbdns.SimpleRecord{

client/internal/peer/conn.go

@@ -669,17 +669,10 @@ func (conn *Conn) isConnectedOnAllWay() (connected bool) {
 		}
 	}()
 
-	// For JS platform: only relay connection is supported
-	if runtime.GOOS == "js" {
-		return conn.statusRelay.Get() == worker.StatusConnected
-	}
-
-	// For non-JS platforms: check ICE connection status
-	if conn.statusICE.Get() == worker.StatusDisconnected && !conn.workerICE.InProgress() {
+	if runtime.GOOS != "js" && conn.statusICE.Get() == worker.StatusDisconnected && !conn.workerICE.InProgress() {
 		return false
 	}
 
-	// If relay is supported with peer, it must also be connected
 	if conn.workerRelay.IsRelayConnectionSupportedWithPeer() {
 		if conn.statusRelay.Get() == worker.StatusDisconnected {
 			return false

client/internal/routemanager/dnsinterceptor/handler.go

@@ -19,7 +19,6 @@ import (
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	nbdns "github.com/netbirdio/netbird/client/internal/dns"
-	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/client/internal/routemanager/common"
@@ -220,14 +219,14 @@ func (d *DnsInterceptor) RemoveAllowedIPs() error {
 
 // ServeDNS implements the dns.Handler interface
 func (d *DnsInterceptor) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
-	logger := log.WithFields(log.Fields{
-		"request_id": resutil.GetRequestID(w),
-		"dns_id":     fmt.Sprintf("%04x", r.Id),
-	})
+	requestID := nbdns.GenerateRequestID()
+	logger := log.WithField("request_id", requestID)
 
 	if len(r.Question) == 0 {
 		return
 	}
+	logger.Tracef("received DNS request for domain=%s type=%v class=%v",
+		r.Question[0].Name, r.Question[0].Qtype, r.Question[0].Qclass)
 
 	// pass if non A/AAAA query
 	if r.Question[0].Qtype != dns.TypeA && r.Question[0].Qtype != dns.TypeAAAA {
@@ -281,10 +280,15 @@ func (d *DnsInterceptor) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 		return
 	}
 
-	resutil.SetMeta(w, "peer", peerKey)
+	var answer []dns.RR
+	if reply != nil {
+		answer = reply.Answer
+	}
+
+	logger.Tracef("upstream %s (%s) DNS response for domain=%s answers=%v", upstreamIP.String(), peerKey, r.Question[0].Name, answer)
 
 	reply.Id = r.Id
-	if err := d.writeMsg(w, reply, logger); err != nil {
+	if err := d.writeMsg(w, reply); err != nil {
 		logger.Errorf("failed writing DNS response: %v", err)
 	}
 }
@@ -320,15 +324,11 @@ func (d *DnsInterceptor) getUpstreamIP(peerKey string) (netip.Addr, error) {
 	return peerAllowedIP, nil
 }
 
-func (d *DnsInterceptor) writeMsg(w dns.ResponseWriter, r *dns.Msg, logger *log.Entry) error {
+func (d *DnsInterceptor) writeMsg(w dns.ResponseWriter, r *dns.Msg) error {
 	if r == nil {
 		return fmt.Errorf("received nil DNS message")
 	}
 
-	// Clear Zero bit from peer responses to prevent external sources from
-	// manipulating our internal fallthrough signaling mechanism
-	r.MsgHdr.Zero = false
-
 	if len(r.Answer) > 0 && len(r.Question) > 0 {
 		origPattern := ""
 		if writer, ok := w.(*nbdns.ResponseWriterChain); ok {
@@ -350,14 +350,14 @@ func (d *DnsInterceptor) writeMsg(w dns.ResponseWriter, r *dns.Msg, logger *log.
 			case *dns.A:
 				addr, ok := netip.AddrFromSlice(rr.A)
 				if !ok {
-					logger.Tracef("failed to convert A record for domain=%s ip=%v", resolvedDomain, rr.A)
+					log.Tracef("failed to convert A record for domain=%s ip=%v", resolvedDomain, rr.A)
 					continue
 				}
 				ip = addr
 			case *dns.AAAA:
 				addr, ok := netip.AddrFromSlice(rr.AAAA)
 				if !ok {
-					logger.Tracef("failed to convert AAAA record for domain=%s ip=%v", resolvedDomain, rr.AAAA)
+					log.Tracef("failed to convert AAAA record for domain=%s ip=%v", resolvedDomain, rr.AAAA)
 					continue
 				}
 				ip = addr
@@ -370,11 +370,11 @@ func (d *DnsInterceptor) writeMsg(w dns.ResponseWriter, r *dns.Msg, logger *log.
 		}
 
 		if len(newPrefixes) > 0 {
-			if err := d.updateDomainPrefixes(resolvedDomain, originalDomain, newPrefixes, logger); err != nil {
-				logger.Errorf("failed to update domain prefixes: %v", err)
+			if err := d.updateDomainPrefixes(resolvedDomain, originalDomain, newPrefixes); err != nil {
+				log.Errorf("failed to update domain prefixes: %v", err)
 			}
 
-			d.replaceIPsInDNSResponse(r, newPrefixes, logger)
+			d.replaceIPsInDNSResponse(r, newPrefixes)
 		}
 	}
 
@@ -386,22 +386,22 @@ func (d *DnsInterceptor) writeMsg(w dns.ResponseWriter, r *dns.Msg, logger *log.
 }
 
 // logPrefixChanges handles the logging for prefix changes
-func (d *DnsInterceptor) logPrefixChanges(resolvedDomain, originalDomain domain.Domain, toAdd, toRemove []netip.Prefix, logger *log.Entry) {
+func (d *DnsInterceptor) logPrefixChanges(resolvedDomain, originalDomain domain.Domain, toAdd, toRemove []netip.Prefix) {
 	if len(toAdd) > 0 {
-		logger.Debugf("added dynamic route(s) for domain=%s (pattern: domain=%s): %s",
+		log.Debugf("added dynamic route(s) for domain=%s (pattern: domain=%s): %s",
 			resolvedDomain.SafeString(),
 			originalDomain.SafeString(),
 			toAdd)
 	}
 	if len(toRemove) > 0 && !d.route.KeepRoute {
-		logger.Debugf("removed dynamic route(s) for domain=%s (pattern: domain=%s): %s",
+		log.Debugf("removed dynamic route(s) for domain=%s (pattern: domain=%s): %s",
 			resolvedDomain.SafeString(),
 			originalDomain.SafeString(),
 			toRemove)
 	}
 }
 
-func (d *DnsInterceptor) updateDomainPrefixes(resolvedDomain, originalDomain domain.Domain, newPrefixes []netip.Prefix, logger *log.Entry) error {
+func (d *DnsInterceptor) updateDomainPrefixes(resolvedDomain, originalDomain domain.Domain, newPrefixes []netip.Prefix) error {
 	d.mu.Lock()
 	defer d.mu.Unlock()
 
@@ -418,9 +418,9 @@ func (d *DnsInterceptor) updateDomainPrefixes(resolvedDomain, originalDomain dom
 			realIP := prefix.Addr()
 			if fakeIP, err := d.fakeIPManager.AllocateFakeIP(realIP); err == nil {
 				dnatMappings[fakeIP] = realIP
-				logger.Tracef("allocated fake IP %s for real IP %s", fakeIP, realIP)
+				log.Tracef("allocated fake IP %s for real IP %s", fakeIP, realIP)
 			} else {
-				logger.Errorf("failed to allocate fake IP for %s: %v", realIP, err)
+				log.Errorf("Failed to allocate fake IP for %s: %v", realIP, err)
 			}
 		}
 	}
@@ -432,7 +432,7 @@ func (d *DnsInterceptor) updateDomainPrefixes(resolvedDomain, originalDomain dom
 		}
 	}
 
-	d.addDNATMappings(dnatMappings, logger)
+	d.addDNATMappings(dnatMappings)
 
 	if !d.route.KeepRoute {
 		// Remove old prefixes
@@ -448,7 +448,7 @@ func (d *DnsInterceptor) updateDomainPrefixes(resolvedDomain, originalDomain dom
 			}
 		}
 
-		d.removeDNATMappings(toRemove, logger)
+		d.removeDNATMappings(toRemove)
 	}
 
 	// Update domain prefixes using resolved domain as key - store real IPs
@@ -463,14 +463,14 @@ func (d *DnsInterceptor) updateDomainPrefixes(resolvedDomain, originalDomain dom
 		// Store real IPs for status (user-facing), not fake IPs
 		d.statusRecorder.UpdateResolvedDomainsStates(originalDomain, resolvedDomain, newPrefixes, d.route.GetResourceID())
 
-		d.logPrefixChanges(resolvedDomain, originalDomain, toAdd, toRemove, logger)
+		d.logPrefixChanges(resolvedDomain, originalDomain, toAdd, toRemove)
 	}
 
 	return nberrors.FormatErrorOrNil(merr)
 }
 
 // removeDNATMappings removes DNAT mappings from the firewall for real IP prefixes
-func (d *DnsInterceptor) removeDNATMappings(realPrefixes []netip.Prefix, logger *log.Entry) {
+func (d *DnsInterceptor) removeDNATMappings(realPrefixes []netip.Prefix) {
 	if len(realPrefixes) == 0 {
 		return
 	}
@@ -484,9 +484,9 @@ func (d *DnsInterceptor) removeDNATMappings(realPrefixes []netip.Prefix, logger
 		realIP := prefix.Addr()
 		if fakeIP, exists := d.fakeIPManager.GetFakeIP(realIP); exists {
 			if err := dnatFirewall.RemoveInternalDNATMapping(fakeIP); err != nil {
-				logger.Errorf("failed to remove DNAT mapping for %s: %v", fakeIP, err)
+				log.Errorf("Failed to remove DNAT mapping for %s: %v", fakeIP, err)
 			} else {
-				logger.Debugf("removed DNAT mapping: %s -> %s", fakeIP, realIP)
+				log.Debugf("Removed DNAT mapping for: %s -> %s", fakeIP, realIP)
 			}
 		}
 	}
@@ -502,7 +502,7 @@ func (d *DnsInterceptor) internalDnatFw() (internalDNATer, bool) {
 }
 
 // addDNATMappings adds DNAT mappings to the firewall
-func (d *DnsInterceptor) addDNATMappings(mappings map[netip.Addr]netip.Addr, logger *log.Entry) {
+func (d *DnsInterceptor) addDNATMappings(mappings map[netip.Addr]netip.Addr) {
 	if len(mappings) == 0 {
 		return
 	}
@@ -514,9 +514,9 @@ func (d *DnsInterceptor) addDNATMappings(mappings map[netip.Addr]netip.Addr, log
 
 	for fakeIP, realIP := range mappings {
 		if err := dnatFirewall.AddInternalDNATMapping(fakeIP, realIP); err != nil {
-			logger.Errorf("failed to add DNAT mapping %s -> %s: %v", fakeIP, realIP, err)
+			log.Errorf("Failed to add DNAT mapping %s -> %s: %v", fakeIP, realIP, err)
 		} else {
-			logger.Debugf("added DNAT mapping: %s -> %s", fakeIP, realIP)
+			log.Debugf("Added DNAT mapping: %s -> %s", fakeIP, realIP)
 		}
 	}
 }
@@ -528,12 +528,12 @@ func (d *DnsInterceptor) cleanupDNATMappings() {
 	}
 
 	for _, prefixes := range d.interceptedDomains {
-		d.removeDNATMappings(prefixes, log.NewEntry(log.StandardLogger()))
+		d.removeDNATMappings(prefixes)
 	}
 }
 
 // replaceIPsInDNSResponse replaces real IPs with fake IPs in the DNS response
-func (d *DnsInterceptor) replaceIPsInDNSResponse(reply *dns.Msg, realPrefixes []netip.Prefix, logger *log.Entry) {
+func (d *DnsInterceptor) replaceIPsInDNSResponse(reply *dns.Msg, realPrefixes []netip.Prefix) {
 	if _, ok := d.internalDnatFw(); !ok {
 		return
 	}
@@ -549,7 +549,7 @@ func (d *DnsInterceptor) replaceIPsInDNSResponse(reply *dns.Msg, realPrefixes []
 
 			if fakeIP, exists := d.fakeIPManager.GetFakeIP(realIP); exists {
 				rr.A = fakeIP.AsSlice()
-				logger.Tracef("replaced real IP %s with fake IP %s in DNS response", realIP, fakeIP)
+				log.Tracef("Replaced real IP %s with fake IP %s in DNS response", realIP, fakeIP)
 			}
 
 		case *dns.AAAA:
@@ -560,7 +560,7 @@ func (d *DnsInterceptor) replaceIPsInDNSResponse(reply *dns.Msg, realPrefixes []
 
 			if fakeIP, exists := d.fakeIPManager.GetFakeIP(realIP); exists {
 				rr.AAAA = fakeIP.AsSlice()
-				logger.Tracef("replaced real IP %s with fake IP %s in DNS response", realIP, fakeIP)
+				log.Tracef("Replaced real IP %s with fake IP %s in DNS response", realIP, fakeIP)
 			}
 		}
 	}

dns/dns.go

@@ -47,8 +47,8 @@ type CustomZone struct {
 	Records []SimpleRecord
 	// SearchDomainDisabled indicates whether to add match domains to a search domains list or not
 	SearchDomainDisabled bool
-	// NonAuthoritative marks user-created zones
-	NonAuthoritative bool
+	// SkipPTRProcess indicates whether a client should process PTR records from custom zones
+	SkipPTRProcess bool
 }
 
 // SimpleRecord provides a simple DNS record specification for CNAME, A and AAAA records

management/internals/shared/grpc/conversion.go

@@ -374,9 +374,8 @@ func shouldUsePortRange(rule *proto.FirewallRule) bool {
 // Helper function to convert nbdns.CustomZone to proto.CustomZone
 func convertToProtoCustomZone(zone nbdns.CustomZone) *proto.CustomZone {
 	protoZone := &proto.CustomZone{
-		Domain:           zone.Domain,
-		Records:          make([]*proto.SimpleRecord, 0, len(zone.Records)),
-		NonAuthoritative: zone.NonAuthoritative,
+		Domain:  zone.Domain,
+		Records: make([]*proto.SimpleRecord, 0, len(zone.Records)),
 	}
 	for _, record := range zone.Records {
 		protoZone.Records = append(protoZone.Records, &proto.SimpleRecord{

shared/management/proto/management.pb.go

@@ -2873,7 +2873,7 @@ type CustomZone struct {
 	Domain               string          `protobuf:"bytes,1,opt,name=Domain,proto3" json:"Domain,omitempty"`
 	Records              []*SimpleRecord `protobuf:"bytes,2,rep,name=Records,proto3" json:"Records,omitempty"`
 	SearchDomainDisabled bool            `protobuf:"varint,3,opt,name=SearchDomainDisabled,proto3" json:"SearchDomainDisabled,omitempty"`
-	NonAuthoritative     bool            `protobuf:"varint,4,opt,name=NonAuthoritative,proto3" json:"NonAuthoritative,omitempty"`
+	SkipPTRProcess       bool            `protobuf:"varint,4,opt,name=SkipPTRProcess,proto3" json:"SkipPTRProcess,omitempty"`
 }
 
 func (x *CustomZone) Reset() {
@@ -2929,9 +2929,9 @@ func (x *CustomZone) GetSearchDomainDisabled() bool {
 	return false
 }
 
-func (x *CustomZone) GetNonAuthoritative() bool {
+func (x *CustomZone) GetSkipPTRProcess() bool {
 	if x != nil {
-		return x.NonAuthoritative
+		return x.SkipPTRProcess
 	}
 	return false
 }

shared/management/proto/management.proto

@@ -464,9 +464,7 @@ message CustomZone {
   string Domain = 1;
   repeated SimpleRecord Records = 2;
   bool SearchDomainDisabled = 3;
-  // NonAuthoritative indicates this is a user-created zone (not the built-in peer DNS zone).
-  // Non-authoritative zones will fallthrough to lower-priority handlers on NXDOMAIN and skip PTR processing.
-  bool NonAuthoritative = 4;
+  bool SkipPTRProcess = 4;
 }
 
 // SimpleRecord represents a dns.SimpleRecord