From 51e1e6dd9e631b5e0000910dbd70d93b6a794a60 Mon Sep 17 00:00:00 2001
From: bert hubert <bert.hubert@netherlabs.nl>
Date: Mon, 22 Feb 2016 15:27:42 +0100
Subject: [PATCH] don't add NSEC/NSEC3 unless the packet asked for DNSSEC
 records

---
 pdns/syncres.cc | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index ea0aadd085..4332fd714f 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -1331,13 +1331,15 @@ int SyncRes::doResolveAt(map<DNSName, pair<ComboAddress, bool> > &nameservers, D
       if(lwr.d_rcode==RCode::NXDomain) {
         LOG(prefix<<qname.toString()<<": status=NXDOMAIN, we are done "<<(negindic ? "(have negative SOA)" : "")<<endl);
 
-	addNXNSECS(ret, lwr.d_records);
+        if(d_doDNSSEC)
+          addNXNSECS(ret, lwr.d_records);
 
         return RCode::NXDomain;
       }
       if(nsset.empty() && !lwr.d_rcode && (negindic || lwr.d_aabit || sendRDQuery)) {
         LOG(prefix<<qname.toString()<<": status=noerror, other types may exist, but we are done "<<(negindic ? "(have negative SOA) " : "")<<(lwr.d_aabit ? "(have aa bit) " : "")<<endl);
-	addNXNSECS(ret, lwr.d_records);
+        if(d_doDNSSEC)
+          addNXNSECS(ret, lwr.d_records);
         return 0;
       }
       else if(realreferral) {
-- 
2.47.3