From 8852fc25eb6045bb00e5aaf5b46b92a69bf32665 Mon Sep 17 00:00:00 2001
From: Chris Hofstaedtler <chris.hofstaedtler@deduktiva.com>
Date: Fri, 27 Sep 2024 08:21:32 +0200
Subject: [PATCH] auth: optimize !d_doResolveAcrossZones case

---
 pdns/packethandler.cc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index f2a570a274..32f176c84d 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -1517,6 +1517,12 @@ std::unique_ptr<DNSPacket> PacketHandler::doQuestion(DNSPacket& p)
       return r;
     }
 
+    if (retargetcount > 0 && !d_doResolveAcrossZones && !target.isPartOf(r->qdomainzone)) {
+      // We are following a retarget outside the initial zone (and do not need to check getAuth to know this). Config asked us not to do that.
+      // This is a performance optimization, the generic case is checked after getAuth below.
+      goto sendit;  // NOLINT(cppcoreguidelines-avoid-goto)
+    }
+
     if(!B.getAuth(target, p.qtype, &d_sd)) {
       DLOG(g_log<<Logger::Error<<"We have no authority over zone '"<<target<<"'"<<endl);
       if(!retargetcount) {
-- 
2.47.2