Integrate the DNS search domain fallbacks

[FR4NK-W]

Make use of the DNS search domain fallbacks:
If no DNS search domain is discovered by the other hinters before the timeout is about to expire, use the public IP(s) of the host and reverse DNS to discover candidate DNS search domains. If there are no public IPs, use external DNS servers to discover publicly reachable IPs.

[marcfrei]

LGTM

[FR4NK-W]

@marcfrei : You mentioned some potential concerns about sending more information than strictly necessary about the host environment to a third party in #22 :

Could this raise privacy concerns, since we are leaking information to external services?

These DNS fallbacks are explicitly only used when there is no local DNS search domains configured and all other methods failed. The only information leaked is the external IP address. This does not provide external services (Akamai, Quad9) with any other information they would not get when querying the DNS system for one of their hosts.
We only use the external DNS resolver if required for getting a reply.

Let's discuss further in PR #23 ?

As mentioned in #22, I believe the information obtained by the third party, specifically the external IP of the host, is only provided if necessary for the bootstrapper to work, and only when the other mechanisms for obtaining a search domain failled. So only in

bootstrapper/hinting/dns_search_domain_fallbacks.go

Line 48 in f3ccde0

ip, err := queryExternalIP()

we use DNS to resolve an external IP, which is no different from using an open resolver, except that the only query we do is related to the host IP and no hostname or search domain information is shared.

Now, using an external resolver could raise concerns in a split DNS environment, where direct communication with external resolvers is explicitly not desired.
If you think this is a valid concern, we could add some additional mitigations for it, e.g. after

bootstrapper/hinting/dns_search_domain_fallbacks_reverse.go

Line 38 in f3ccde0

nameservers, err := resolver.LookupNS(ctx, akamaiDomain)

by explicitly checking which type of error occurred, before resorting to using the external open resolver. For example, we could abort the fallback if we receive a NXDOMAIN response, since we know that the record should exist and is deliberately shadowed if we get such a response.

Please let me know if you can think of any other information exposure!