Fix tunnel check failing all resolvers on subdomain delegations

QueryNS only checked the Answer section for NS records, but for
subdomain delegations (e.g. t.example.com) most resolvers return
NS records in the Authority section. Now checks both.

Author: SamNet-dev

internal/scanner/dns.go

@@ -40,11 +40,20 @@ func QueryNS(resolver, domain string, timeout time.Duration) ([]string, bool) {
 		return nil, false
 	}
 	var hosts []string
+	// Check Answer section first
 	for _, ans := range r.Answer {
 		if ns, ok := ans.(*dns.NS); ok {
 			hosts = append(hosts, ns.Ns)
 		}
 	}
+	// For subdomain delegations, NS records are often in the Authority section
+	if len(hosts) == 0 {
+		for _, ans := range r.Ns {
+			if ns, ok := ans.(*dns.NS); ok {
+				hosts = append(hosts, ns.Ns)
+			}
+		}
+	}
 	if len(hosts) == 0 {
 		return nil, false
 	}

internal/scanner/doh.go

@@ -83,11 +83,20 @@ func QueryDoHNS(resolverURL, domain string, timeout time.Duration) ([]string, bo
 		return nil, false
 	}
 	var hosts []string
+	// Check Answer section first
 	for _, ans := range r.Answer {
 		if ns, ok := ans.(*dns.NS); ok {
 			hosts = append(hosts, ns.Ns)
 		}
 	}
+	// For subdomain delegations, NS records are often in the Authority section
+	if len(hosts) == 0 {
+		for _, ans := range r.Ns {
+			if ns, ok := ans.(*dns.NS); ok {
+				hosts = append(hosts, ns.Ns)
+			}
+		}
+	}
 	if len(hosts) == 0 {
 		return nil, false
 	}