Function mask_remote_failure 

fn mask_remote_failure(
    services: &Services,
    server: Option<&ServerName>,
    error: Error,
) -> Error

Masks a remote directory failure behind a generic gateway error.

The remote chooses its own error, so forwarding one verbatim lets a third party pick what our client sees. A query served locally contacts nobody, so its error is returned unchanged rather than relabelled as an upstream failure.