From ac891f58f686fbd59931913b0d53e865b7ee5099 Mon Sep 17 00:00:00 2001
From: Miod Vallat <miod.vallat@powerdns.com>
Date: Wed, 23 Apr 2025 15:18:27 +0200
Subject: [PATCH] Update pdns/packethandler.cc

No need to complain about the lack of DNSSEC if NSEC3 narrow mode.

Co-authored-by: Peter van Dijk <peter.van.dijk@powerdns.com>
---
 pdns/packethandler.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 035a091780..c3c6215842 100644
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -885,7 +885,7 @@ void PacketHandler::addNSEC3(DNSPacket& p, std::unique_ptr<DNSPacket>& r, const
     }
   }
 
-  if (!d_sd.db->doesDNSSEC()) {
+  if (!d_sd.db->doesDNSSEC() && !narrow) {
     // We are in a configuration where the zone is primarily served by a
     // non-DNSSEC-capable backend, but DNSSEC keys have been added to the
     // zone in a second, DNSSEC-capable backend, which caused d_dnssec to
-- 
2.47.2