Fix internal cache TTL computation for dnsx responses

[Copilot]

Internal cache lookups for A/AAAA returned valid IPs but reported zero TTL in logs, causing misleading negative/zero “until” values.

• TTL aggregation: track the first positive remaining TTL and take the non-zero minimum across cached entries instead of falling back to zero.
• Safety helper: add minNonZeroDuration to avoid zeroing TTL when one of the durations is unset.
• Regression test: new dnsx test ensures cached answers preserve their remaining TTL (no fallback to minimum).

Example:

// Before: until became 0 when the first value was zero
until = min(until, life)

// After: keep earliest positive TTL, ignore zeros
until = minNonZeroDuration(until, life)

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• 149.112.112.12
  • Triggering command: /tmp/go-build1865339687/b362/dnscrypt.test /tmp/go-build1865339687/b362/dnscrypt.test -test.testlogfile=/tmp/go-build1865339687/b362/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1865339687/b253/vet.cfg g_.a 0.1-go1.25.0.lingvisor.dev/gvisor/pkg/tcpip/network/internal/multicast ux-amd64/pkg/tool/linux_amd64/vet (packet block)
• api2.sec-tunnel.com
  • Triggering command: /tmp/go-build1865339687/b359/dns53.test /tmp/go-build1865339687/b359/dns53.test -test.testlogfile=/tmp/go-build1865339687/b359/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1865339687/b244/vet.cfg (dns block)
• cloudflare.com
  • Triggering command: /tmp/go-build1865339687/b359/dns53.test /tmp/go-build1865339687/b359/dns53.test -test.testlogfile=/tmp/go-build1865339687/b359/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1865339687/b244/vet.cfg (dns block)
• dns.google
  • Triggering command: /tmp/go-build1865339687/b371/multihost.test /tmp/go-build1865339687/b371/multihost.test -test.testlogfile=/tmp/go-build1865339687/b371/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1865339687/b274/vet.cfg g_.a (dns block)
• foo.test
  • Triggering command: /tmp/go-build1865339687/b382/protect.test /tmp/go-build1865339687/b382/protect.test -test.testlogfile=/tmp/go-build1865339687/b382/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1865339687/b256/vet.cfg (dns block)
• google.com
  • Triggering command: /tmp/go-build1865339687/b359/dns53.test /tmp/go-build1865339687/b359/dns53.test -test.testlogfile=/tmp/go-build1865339687/b359/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1865339687/b244/vet.cfg (dns block)
• microsoft.com
  • Triggering command: /tmp/go-build1865339687/b359/dns53.test /tmp/go-build1865339687/b359/dns53.test -test.testlogfile=/tmp/go-build1865339687/b359/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1865339687/b244/vet.cfg (dns block)
• one.one.one.one
  • Triggering command: /tmp/go-build1865339687/b371/multihost.test /tmp/go-build1865339687/b371/multihost.test -test.testlogfile=/tmp/go-build1865339687/b371/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1865339687/b274/vet.cfg g_.a (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>internal cache ttl is always zero</issue_title>
<issue_description>```
E transport.go:812@dnsx.(*resolver).dnsudp>transport.go:601@dnsx.(*resolver).forward>alg.go:1138@dnsx.(*dnsgateway).q>alg.go:944@dnsx.(*dnsgateway).qp>alg.go:933: : alg: response for opensource.org by CachePreferred[10161] (q4? false / q6? true) realip; in cache? [] [ttl: 8s / -ve? true / until: 0ms]
2025-12-16 21:23:19.553 28356-28540 GoLog com.celzero.bravedns I E (or stale? [])

<agent_instructions>alg.go fromInternalCache returns valid (not stale) IPs but with their "until" (which is set to min if multiple IPs from different DNS answers with different TTLs were ingested in, prior) set to 0. This appears like an error but very well might genuinely be expected and not an error. Find any obvious business logic error or edge cases or mistakes in the code which could have lead to it. </agent_instructions>

## Comments on the Issue (you are @copilot in this section)

<comments>
</comments>

• Fixes internal cache ttl is always zero #208

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[ignoramous]

Got it wrong 7ee1cd2