fix: resolve DNSSEC validation issue for CNAMEs in unsigned zones

[0xERR0R]

closes #1926

[codecov]

Codecov Report

❌ Patch coverage is 22.38806% with 52 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.83%. Comparing base (0a3c724) to head (4630bb5).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
resolver/dnssec/validator.go	22.38%	46 Missing and 6 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1930      +/-   ##
==========================================
- Coverage   92.58%   91.83%   -0.76%     
==========================================
  Files          90       90              
  Lines        6193     6257      +64     
==========================================
+ Hits         5734     5746      +12     
- Misses        335      381      +46     
- Partials      124      130       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull Request Overview

This PR fixes issue #1926 where DNSSEC validation incorrectly rejected CNAMEs in unsigned zones as "bogus signatures." The fix implements proper zone security status checking to distinguish between unsigned zones (Insecure) and improperly signed zones (Bogus), following RFC 4035 §5.2.

Key Changes:

• Modified validateRRsets to handle mixed security statuses in CNAME chains crossing zone boundaries
• Enhanced validateSingleRRset to check zone security status before treating missing RRSIGs as Bogus
• Added checkZoneSecurityStatus function to determine if a zone is signed by checking DS records
• Added handleNoDSRecords helper to evaluate zone security when DS records are absent

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
resolver/dnssec/validator.go	Implements zone security status checking logic to properly handle unsigned zones and mixed signed/unsigned CNAME chains
resolver/dnssec/validator_test.go	Adds test coverage for CNAME validation in unsigned zones and updates existing test to verify Bogus detection in signed zones

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The Indeterminate result is not cached when the parent zone is Secure but no DS records are found. This could lead to repeated queries for the same domain across multiple validation requests. Consider caching the Indeterminate result to improve performance.

Suggested fix:

if parentResult == ValidationResultSecure {
	// Parent is signed, so this non-delegation should have been signed too
	v.logger.Debugf("Parent zone %s is secure but %s has no DS - treating as indeterminate", parentDomain, domain)
	result := ValidationResultIndeterminate
	v.setCachedValidation(domain, result)
	
	return result
}

Suggested change

	return ValidationResultIndeterminate
	result := ValidationResultIndeterminate
	v.setCachedValidation(domain, result)
	return result