middleware/proxy: healthchecks fixes (#183)

* middleware/proxy: add spray keyword

When spray is used, the proxy will, when all backend are down, spray to
each target. When not used, default to the old defaults: max 1 failure
and no spray. These defaults are also used when forwarding queries to
another CoreDNS instance.

Update the README with the new keyword.

* typos

* Make MaxFail = 1 again

* more reversals

middleware/proxy/README.md

@@ -2,7 +2,8 @@
 
 `proxy` facilitates both a basic reverse proxy and a robust load balancer. The proxy has support for
 multiple backends and adding custom headers. The load balancing features include multiple policies,
-health checks, and failovers.
+health checks, and failovers. If all hosts fails their health check the proxy middleware will fail
+back to randomly selecting a target and sending packets to it.
 
 ## Syntax
 
@@ -24,7 +25,7 @@ proxy from to... {
     max_fails integer
     health_check path:port [duration]
     except ignored_names...
-    ecs [v4 address/mask] [v6 address/mask] (TODO)
+    spray
 }
 ~~~
 
@@ -35,8 +36,7 @@ proxy from to... {
 * `max_fails` is the number of failures within fail_timeout that are needed before considering a backend to be down. If 0, the backend will never be marked as down. Default is 1.
 * `health_check` will check path (on port) on each backend. If a backend returns a status code of 200-399, then that backend is healthy. If it doesn't, the backend is marked as unhealthy for duration and no requests are routed to it. If this option is not provided then health checks are disabled. The default duration is 10 seconds ("10s").
 * `ignored_names...` is a space-separated list of paths to exclude from proxying. Requests that match any of these paths will be passed thru.
-* `ecs` add EDNS0 client submit metadata to the outgoing query. This can be optionally be followed
-  by an IPv4 and/or IPv6 address. If none is specified the server's addresses are used.
+* `spray` when all backends are unhealth randomly pick one to send the traffic to (this is a failsafe).
 
 ## Policies