This fixes a crash when we resolve (or try to) an external CNAME when no proxy is set. Add test as well.
Add support for wildcard records, while taking care of wildcard-cnames and DNSSEC. Add enough tests to check all the corner cases.