diff --git a/firewall/interception/nfqexp/nfqexp.go b/firewall/interception/nfqexp/nfqexp.go
index aa8cc451..4c0d7e45 100644
--- a/firewall/interception/nfqexp/nfqexp.go
+++ b/firewall/interception/nfqexp/nfqexp.go
@@ -28,7 +28,7 @@ type Queue struct {
 }
 
 // New opens a new nfQueue.
-func New(qid uint16, v6 bool) (*Queue, error) {
+func New(qid uint16, v6 bool) (*Queue, error) { //nolint:gocognit
 	afFamily := unix.AF_INET
 	if v6 {
 		afFamily = unix.AF_INET6
diff --git a/intel/block_reason.go b/intel/block_reason.go
index 266e7140..6ec51cb0 100644
--- a/intel/block_reason.go
+++ b/intel/block_reason.go
@@ -64,7 +64,7 @@ func (br ListBlockReason) MarshalJSON() ([]byte, error) {
 	})
 }
 
-// GetExtraRR implements the nsutil.RRProvider interface
+// GetExtraRRs implements the nsutil.RRProvider interface
 // and adds additional TXT records justifying the reason
 // the request was blocked.
 func (br ListBlockReason) GetExtraRRs(ctx context.Context, _ *dns.Msg) []dns.RR {
diff --git a/nameserver/nsutil/nsutil.go b/nameserver/nsutil/nsutil.go
index cd42daba..7307f763 100644
--- a/nameserver/nsutil/nsutil.go
+++ b/nameserver/nsutil/nsutil.go
@@ -79,6 +79,7 @@ func ZeroIP(msg string) ResponderFunc {
 	}
 }
 
+// Localhost is a ResponderFunc than replies with localhost IP addresses.
 func Localhost(msg string) ResponderFunc {
 	return func(ctx context.Context, request *dns.Msg) *dns.Msg {
 		reply := new(dns.Msg)
@@ -145,7 +146,9 @@ func ServerFailure(msg string) ResponderFunc {
 	}
 }
 
-func MakeMessageRecord(level log.Severity, msg string) (dns.RR, error) {
+// MakeMessageRecord creates an informational resource record that can be added
+// to the extra section of a reply.
+func MakeMessageRecord(level log.Severity, msg string) (dns.RR, error) { //nolint:interfacer
 	return dns.NewRR(fmt.Sprintf(
 		`%s.portmaster. 0 IN TXT "%s"`,
 		strings.ToLower(level.String()),
@@ -153,6 +156,10 @@ func MakeMessageRecord(level log.Severity, msg string) (dns.RR, error) {
 	))
 }
 
+// AddMessageToReply creates an information resource records using
+// MakeMessageRecord and immediately adds it the the extra section of the given
+// reply. If an error occurs, the resource record will not be added, and the
+// error will be logged.
 func AddMessageToReply(ctx context.Context, reply *dns.Msg, level log.Severity, msg string) {
 	if msg != "" {
 		rr, err := MakeMessageRecord(level, msg)
diff --git a/resolver/resolver-tcp.go b/resolver/resolver-tcp.go
index 54a7a8f5..ff915b97 100644
--- a/resolver/resolver-tcp.go
+++ b/resolver/resolver-tcp.go
@@ -239,7 +239,7 @@ func (mgr *tcpResolverConnMgr) run(workerCtx context.Context) error {
 		}
 
 		// create connection
-		conn, connClosing, connCtx, cancelConnCtx := mgr.establishConnection(workerCtx)
+		conn, connClosing, connCtx, cancelConnCtx := mgr.establishConnection()
 		if conn == nil {
 			mgr.failCnt++
 			continue
@@ -324,7 +324,7 @@ func (mgr *tcpResolverConnMgr) waitForWork(workerCtx context.Context) (proceed b
 	return true
 }
 
-func (mgr *tcpResolverConnMgr) establishConnection(workerCtx context.Context) (
+func (mgr *tcpResolverConnMgr) establishConnection() (
 	conn *dns.Conn,
 	connClosing *abool.AtomicBool,
 	connCtx context.Context,
diff --git a/resolver/rrcache.go b/resolver/rrcache.go
index 24866455..0c24f4c8 100644
--- a/resolver/rrcache.go
+++ b/resolver/rrcache.go
@@ -274,35 +274,35 @@ func (rrCache *RRCache) ReplyWithDNS(ctx context.Context, request *dns.Msg) *dns
 func (rrCache *RRCache) GetExtraRRs(ctx context.Context, query *dns.Msg) (extra []dns.RR) {
 	// Add cache status and source of data.
 	if rrCache.servedFromCache {
-		extra = addExtra(ctx, extra, log.InfoLevel, "served from cache, resolved by "+rrCache.ServerInfo)
+		extra = addExtra(ctx, extra, "served from cache, resolved by "+rrCache.ServerInfo)
 	} else {
-		extra = addExtra(ctx, extra, log.InfoLevel, "freshly resolved by "+rrCache.ServerInfo)
+		extra = addExtra(ctx, extra, "freshly resolved by "+rrCache.ServerInfo)
 	}
 
 	// Add expiry and cache information.
 	if rrCache.Expired() {
-		extra = addExtra(ctx, extra, log.InfoLevel, fmt.Sprintf("record expired since %s, requesting new", time.Since(time.Unix(rrCache.TTL, 0))))
+		extra = addExtra(ctx, extra, fmt.Sprintf("record expired since %s, requesting new", time.Since(time.Unix(rrCache.TTL, 0))))
 	} else {
-		extra = addExtra(ctx, extra, log.InfoLevel, fmt.Sprintf("record valid for %s", time.Until(time.Unix(rrCache.TTL, 0))))
+		extra = addExtra(ctx, extra, fmt.Sprintf("record valid for %s", time.Until(time.Unix(rrCache.TTL, 0))))
 	}
 	if rrCache.requestingNew {
-		extra = addExtra(ctx, extra, log.InfoLevel, "async request to refresh the cache has been started")
+		extra = addExtra(ctx, extra, "async request to refresh the cache has been started")
 	}
 
 	// Add information about filtered entries.
 	if rrCache.Filtered {
 		if len(rrCache.FilteredEntries) > 1 {
-			extra = addExtra(ctx, extra, log.InfoLevel, fmt.Sprintf("%d records have been filtered", len(rrCache.FilteredEntries)))
+			extra = addExtra(ctx, extra, fmt.Sprintf("%d records have been filtered", len(rrCache.FilteredEntries)))
 		} else {
-			extra = addExtra(ctx, extra, log.InfoLevel, fmt.Sprintf("%d record has been filtered", len(rrCache.FilteredEntries)))
+			extra = addExtra(ctx, extra, fmt.Sprintf("%d record has been filtered", len(rrCache.FilteredEntries)))
 		}
 	}
 
 	return extra
 }
 
-func addExtra(ctx context.Context, extra []dns.RR, level log.Severity, msg string) []dns.RR {
-	rr, err := nsutil.MakeMessageRecord(level, msg)
+func addExtra(ctx context.Context, extra []dns.RR, msg string) []dns.RR {
+	rr, err := nsutil.MakeMessageRecord(log.InfoLevel, msg)
 	if err != nil {
 		log.Tracer(ctx).Warningf("resolver: failed to add informational record to reply: %s", err)
 		return extra