From d8049162693edeaa69b31fcec42fc9629e0c7227 Mon Sep 17 00:00:00 2001
From: Peter van Dijk <peter.van.dijk@powerdns.com>
Date: Tue, 12 Jan 2016 18:23:42 +0100
Subject: [PATCH] reduce breakage for insecure domains

Send DS queries to parent side of zone cut instead of child
---
 pdns/syncres.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 9659966858..5b3321bdac 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -430,6 +430,7 @@ int SyncRes::doResolve(const DNSName &qname, const QType &qtype, vector<DNSRecor
   LOG(prefix<<qname.toString()<<": No cache hit for '"<<qname.toString()<<"|"<<qtype.getName()<<"', trying to find an appropriate NS record"<<endl);
 
   DNSName subdomain(qname);
+  if(qtype == QType::DS) subdomain.chopOff();
 
   set<DNSName> nsset;
   bool flawedNSSet=false;
-- 
2.47.2