Even for HardenNXD::Yes we don't want to believe Bogus NXDOMAINs.

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index e2aa148a48e9707962226e10ab7b4d4ca302ba98..3ffeae0dbaa331784dedb614f802b9148a4a946a 100644 (file)
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -1427,7 +1427,7 @@ bool SyncRes::doCacheCheck(const DNSName &qname, const DNSName& authname, bool w
           // And get the updated ne struct
           //t_sstorage.negcache.get(negCacheName, QType(0), d_now, &ne, true);
         }
-        if (s_hardenNXD == HardenNXD::Yes || ne->d_validationState == Secure) {
+        if ((s_hardenNXD == HardenNXD::Yes && ne->d_validationState != Bogus) || ne->d_validationState == Secure) {
           res = RCode::NXDomain;
           sttl = ne->d_ttd - d_now.tv_sec;
           giveNegative = true;