Label DNS policy redirects accurately

The query log classified every non-drop blocklist match as a block, even when an RPZ A or CNAME rule returned a successful redirect. Record redirect results with their own action so NOERROR address overrides are not presented or counted as blocked. Expose the new action in the Logs filter.

internal/engine/engine.go

@@ -368,6 +368,13 @@ func (e *Engine) Handle(ctx context.Context, req Request) Response {
 			res.Duration = time.Since(start)
 			e.finish(req, res, start, decision)
 			return res
+		case blocklist.ActionRedirect, blocklist.ActionCNAME:
+			res.Msg = e.finalize(e.blockedMsg(q, blocked), q, req)
+			res.Action = qlog.ActionRedirect
+			res.BlockSource = blocked.Source
+			res.CacheHit = false
+			e.finish(req, res, start, decision)
+			return res
 		default:
 			res.Msg = e.finalize(e.blockedMsg(q, blocked), q, req)
 			res.Action = qlog.ActionBlock
@@ -502,6 +509,8 @@ func outcomeFor(res Response) string {
 		return metrics.OutcomeCache
 	case qlog.ActionBlock:
 		return metrics.OutcomeBlocked
+	case qlog.ActionRedirect:
+		return metrics.OutcomeLocal
 	case qlog.ActionError, qlog.ActionDrop:
 		return metrics.OutcomeError
 	case qlog.ActionRefused:

internal/qlog/qlog.go

@@ -28,6 +28,8 @@ const (
 	ActionAllow Action = "allow"
 	// ActionBlock is a blocklist hit.
 	ActionBlock Action = "block"
+	// ActionRedirect is a blocklist rewrite to an address or CNAME target.
+	ActionRedirect Action = "redirect"
 	// ActionCached is a cache hit.
 	ActionCached Action = "cached"
 	// ActionError is a SERVFAIL or other failure.
@@ -246,11 +248,11 @@ var (
 )
 
 // ShouldLog reports whether an entry with this action passes the sampling
-// policy. Blocked, cached and error entries are always kept when their
-// category flag is set; ordinary resolutions are sampled.
+// policy. Blocked, redirected, cached and error entries are always kept when
+// their category flag is set; ordinary resolutions are sampled.
 func (l *Logger) ShouldLog(a Action) bool {
 	switch a {
-	case ActionBlock:
+	case ActionBlock, ActionRedirect:
 		return l.opts.LogBlocked
 	case ActionCached:
 		return l.opts.LogCached