bug(resolve_dns): SERVFAIL is reported as a successful no-record answer

[cyanheads]

Server version

0.1.1

mcp-ts-core version

0.10.6

Runtime

Bun

Runtime version

Bun 1.3.14

Transport

stdio

OS

macOS 26.1

Description

attacksurface_resolve_dns suppresses a resolver ESERVFAIL response as if the requested record does not exist. The output reports error: null at both the resolver and host levels, so callers cannot distinguish an upstream DNS failure from a valid no-record answer.

Steps to reproduce

1. Call attacksurface_resolve_dns with {"hosts":["broken.example.com"],"recordTypes":["A"],"resolvers":["8.8.8.8"],"reverse":false}.
2. Have the resolver return an error with code: "ESERVFAIL" and message "upstream SERVFAIL" for the A query.
3. Inspect results[0].error and results[0].resolverResults[0].error.

Actual behavior

{
  "resolved": false,
  "records": {},
  "error": null,
  "resolverResults": [
    { "resolver": "8.8.8.8", "records": {}, "error": null }
  ]
}

Expected behavior

The resolver and host error fields should preserve "upstream SERVFAIL". Only true no-record responses such as ENODATA and ENOTFOUND should be normalized to an empty successful answer.

Additional context

The failure is reproducible with a deterministic node:dns/promises boundary fake; no live DNS request is required.