A domain's proof is asked of the zone's own nameservers when the box's resolver says no #327

Live on game.cheffryjames.com: the platform's resolver (a caching tailnet DNS) held a "not found" for _forge-verify.game.cheffryjames.com from a minute before the record was published, while every public resolver had it.

• The system resolver is asked first; when it says none, the zone's own nameservers are found by walking up the name and asked directly (withAuthority), the way certificate issuers do.
• Names are asked absolute (trailing dot), so ndots search suffixes never widen the question.
• A resolver that fails in any other way is still believed, not second-guessed.
• Test: a stale not-found → authority found → verified; a SERVFAIL stays a failure.