dns: add LookupTXT to Resolver interface (#2101)

* dns: add LookupTXT to Resolver interface

Mirrors LookupIPAddr / LookupCNAME / LookupNS:

- Resolver interface gains LookupTXT(ctx, domain) ([]string, error)
- DirectResolver.LookupTXT issues a TypeTXT query and joins each
  record's wire-split strings into one entry per RR
- RootResolver.LookupTXT delegates to its per-domain DirectResolver
- MockResolver.LookupTXT reads from Records[{Type:"TXT"}]
- Test mocks (cli.MockResolver, aws.CallbackMockResolver) add stubs
  to keep satisfying the interface

Prereq for the defang-mvp ResolveTXT server handler (which calls
LookupTXT on the resolver) and for the in-flight FabricResolver work
in #2069 (which adds a fabric-backed Resolver impl that will need a
LookupTXT method too).

Standalone from the cert-validation flow on edw/azure-cert-gen — that
branch's cert.go integration uses these primitives but isn't part of
this change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* dns: follow CNAME chains in LookupTXT

A TXT query against a hostname that's actually a CNAME returns only
the CNAME RR — no TXT records — so RootResolver.LookupTXT must follow
the alias, matching how LookupIPAddr handles A/AAAA over CNAME.

DirectResolver.LookupTXT now captures any CNAME from the answer
section and returns ErrCNAMEFound when the result has no TXT records;
RootResolver.LookupTXT loops up to 10 times following each CNAME.

Without this, _dnsauth.<host> -> CNAME -> Azure-managed validation
record would silently 404, since the upstream wouldn't see the TXT
sitting at the CNAME target.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Edward J <edw@defang.io>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 3 people

src/pkg/cli/cert_test.go

@@ -191,6 +191,10 @@ func (mr *MockResolver) LookupNS(ctx context.Context, domain string) ([]*net.NS,
 	mr.calls++
 	return []*net.NS{{Host: ""}}, nil
 }
+func (mr *MockResolver) LookupTXT(ctx context.Context, domain string) ([]string, error) {
+	mr.calls++
+	return nil, nil
+}
 
 func TestHttpClient(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

src/pkg/cli/client/byoc/aws/domain_test.go

@@ -248,6 +248,12 @@ func (r *CallbackMockResolver) LookupCNAME(ctx context.Context, domain string) (
 	}
 	return r.MockResolver.LookupCNAME(ctx, domain)
 }
+func (r *CallbackMockResolver) LookupTXT(ctx context.Context, domain string) ([]string, error) {
+	if r.Callback != nil {
+		r.Callback(domain)
+	}
+	return r.MockResolver.LookupTXT(ctx, domain)
+}
 
 func TestPrepareDomainDelegation(t *testing.T) {
 	ctx := t.Context()

src/pkg/dns/mock.go

@@ -56,3 +56,6 @@ func (r MockResolver) LookupNS(ctx context.Context, domain string) ([]*net.NS, e
 	ns, err := r.records(DNSRequest{Type: "NS", Domain: domain})
 	return convert(ns, func(n string) *net.NS { return &net.NS{Host: n} }), err
 }
+func (r MockResolver) LookupTXT(ctx context.Context, domain string) ([]string, error) {
+	return r.records(DNSRequest{Type: "TXT", Domain: domain})
+}

src/pkg/dns/resolver.go

@@ -7,6 +7,7 @@ import (
 	"net"
 	"slices"
 	"sort"
+	"strings"
 
 	"github.com/DefangLabs/defang/src/pkg"
 	"github.com/miekg/dns"
@@ -16,6 +17,7 @@ type Resolver interface {
 	LookupIPAddr(ctx context.Context, domain string) ([]net.IPAddr, error)
 	LookupCNAME(ctx context.Context, domain string) (string, error)
 	LookupNS(ctx context.Context, domain string) ([]*net.NS, error)
+	LookupTXT(ctx context.Context, domain string) ([]string, error)
 }
 
 type RootResolver struct{}
@@ -61,6 +63,21 @@ func (r RootResolver) LookupNS(ctx context.Context, domain string) ([]*net.NS, e
 	return r.getResolver(ctx, domain).LookupNS(ctx, domain)
 }
 
+func (r RootResolver) LookupTXT(ctx context.Context, domain string) ([]string, error) {
+	for range 10 {
+		txts, err := r.getResolver(ctx, domain).LookupTXT(ctx, domain)
+		if err != nil {
+			if cnameErr, ok := err.(ErrCNAMEFound); ok {
+				domain = cnameErr.CNAME()
+				continue
+			}
+			return nil, err
+		}
+		return txts, nil
+	}
+	return nil, errors.New("too many CNAME lookups")
+}
+
 func (r RootResolver) getResolver(ctx context.Context, domain string) Resolver {
 	ns, err := FindNSServers(ctx, domain)
 	if err != nil {
@@ -176,6 +193,36 @@ func (r DirectResolver) LookupCNAME(ctx context.Context, domain string) (string,
 	return "", ErrNoSuchHost
 }
 
+func (r DirectResolver) LookupTXT(ctx context.Context, domain string) ([]string, error) {
+	res, err := r.query(ctx, domain, dns.TypeTXT)
+	if err != nil {
+		return nil, err
+	}
+
+	var result []string
+	var cname string
+	// A single TXT response can be split into multiple "strings" on the wire
+	// (each ≤255 bytes); the convention is to concatenate them. miekg/dns
+	// already returns each record's strings as a []string in TXT.Txt, so we
+	// just join those and emit one entry per RR.
+	for _, rr := range res.Answer {
+		if t, ok := rr.(*dns.TXT); ok {
+			result = append(result, strings.Join(t.Txt, ""))
+		} else if cn, ok := rr.(*dns.CNAME); ok {
+			cname = cn.Target
+		}
+	}
+	if len(result) == 0 {
+		// No TXT record but a CNAME — surface it so RootResolver can
+		// follow the alias, matching LookupIPAddr's behavior.
+		if cname != "" {
+			return nil, ErrCNAMEFound(cname)
+		}
+		return nil, ErrNoSuchHost
+	}
+	return result, nil
+}
+
 func (r DirectResolver) LookupNS(ctx context.Context, domain string) ([]*net.NS, error) {
 	res, err := r.query(ctx, domain, dns.TypeNS)
 	if err != nil {