all: safesearch cnames

internal/dnsforward/msg.go

@@ -75,9 +75,14 @@ func (s *Server) genDNSFilterMessage(
 // genFltSafeSearch generates a filtered response to req for safe search filter.
 // Adds a CNAME record if cname if provided.
 func (s *Server) genFltSafeSearch(req *dns.Msg, ips []netip.Addr, cname string) (resp *dns.Msg) {
+	originalName := req.Question[0].Name
+
 	var ans []dns.RR
 	if cname != "" {
 		ans = append(ans, s.genAnswerCNAME(req, cname))
+
+		// The given IPs actually are resolved for this cname.
+		req.Question[0].Name = dns.Fqdn(cname)
 	}
 
 	switch req.Question[0].Qtype {
@@ -93,6 +98,8 @@ func (s *Server) genFltSafeSearch(req *dns.Msg, ips []netip.Addr, cname string)
 		// Go on and return an empty response.
 	}
 
+	req.Question[0].Name = originalName
+
 	resp = s.makeResponse(req)
 	resp.Answer = ans