Add support for blocked replies with NOERROR code and empty answer

[agross]

Hello,

I'm not a Go developer by trade and not a DNS expert; please be gentle.

I found #8024 is affecting me.

The default behavior of returning the null address makes localhost reachable under blocked names. This causes errors and unwanted behavior, like being able to ping blocked hosts (by talking to localhost).

Returning NXDOMAIN or REFUSED, on the other hand, will cause extra DNS queries with the search domain appended, i.e., blocked.example.com becomes blocked.example.com.local.domain.com.

By returning NOERROR without an answer section, these problems go away.

With this patch, AdGuard will return a response similar to resolving a non-existing name, i.e., asking a question but not getting an answer:

$ dig doesntexist.example.com # not blocked
...
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52361
...
;; QUESTION SECTION:
;doesntexist.example.com.       IN      A

;; AUTHORITY SECTION:
example.com.            1708    IN      SOA     elliott.ns.cloudflare.com. dns.cloudflare.com. 2395194487 10000 2400 604800 1800

If NOERROR is selected and a blocked name is requested, it looks like this:

$ dig ogads-pa.clients6.google.com # blocked by AdGuard DNS filter
...
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8474
...
;; QUESTION SECTION:
;ogads-pa.clients6.google.com.  IN      A

;; AUTHORITY SECTION:
ogads-pa.clients6.google.com. 10 IN     SOA     fake-for-negative-caching.adguard.com. hostmaster.ogads-pa.clients6.google.com. 100500 1800 900 604800 86400

Closes #8024

[windsurf-bot]

💡 To request another review, post a new comment with "/windsurf-review".

[windsurf-bot]

The PR adds filtering.BlockingModeNOERROR to the list of valid blocking modes, but I don't see a corresponding implementation in the filtering package. Make sure this mode is properly implemented in the filtering package to handle blocked domains with NOERROR responses without answer sections.

[agross]

This is a new approach to responding to filtered queries, not a new method for filtering.