[SatriaBagusNurhadianto]

What changed:

• internal/dns/ratelimit_test.go: replaced tight upper bound with a hang-only ceiling (5x ideal)
• internal/dns/resolver_test.go: replaced 500ms timing check with query-count assertion
• internal/dnsserver/server_test.go: raised Close ceiling from 2s to 10s

Why:
Three tests asserted tight wall-clock upper bounds that flake under load on slow CI runners. Lower bounds and hang-only ceilings remain.

Tests:

• go test ./internal/dns/ ./internal/dnsserver/ (pass)
• go test -count=5 -shuffle=on (pass, GOMAXPROCS=2)
• -race could not run locally (no cgo/gcc)

Related: #206

[TMHSDigital]

Thanks for this! It's merged as 30d50f9. The rate-limiter and cancelled-context changes went in as you wrote them; asserting srv.Queries() == 0 is a better check than the timing it replaced.

I made one follow-up in 3a30307. The Close ceiling is now 4s instead of 10s. A parked stream connection that Close fails to close is still released by serveTCP's 5s read deadline (server.go:287). If that regression came back, Close would return in about 5s and pass a 10s ceiling. I checked this by mutating Close to skip closing tracked connections: the test passed at 10s and failed at 4s. 4s still gives about 20x headroom over the normal ~200ms.

go test -race -count=5 -shuffle=on ./internal/dns/ ./internal/dnsserver/ with GOMAXPROCS=2 passes, and CI on main is green.