From: Miod Vallat <miod.vallat@powerdns.com>
Date: Wed, 23 Apr 2025 13:18:27 +0000 (+0200)
Subject: Update pdns/packethandler.cc
X-Git-Tag: dnsdist-2.0.0-alpha2~65^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F15451%2Fhead;p=thirdparty%2Fpdns.git

Update pdns/packethandler.cc

No need to complain about the lack of DNSSEC if NSEC3 narrow mode.

Co-authored-by: Peter van Dijk <peter.van.dijk@powerdns.com>
---

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 035a091780..c3c6215842 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -885,7 +885,7 @@ void PacketHandler::addNSEC3(DNSPacket& p, std::unique_ptr<DNSPacket>& r, const
     }
   }
 
-  if (!d_sd.db->doesDNSSEC()) {
+  if (!d_sd.db->doesDNSSEC() && !narrow) {
     // We are in a configuration where the zone is primarily served by a
     // non-DNSSEC-capable backend, but DNSSEC keys have been added to the
     // zone in a second, DNSSEC-capable backend, which caused d_dnssec to