If we have root-nx-trust on (default) and we have an neg SOA for ., and we sent to...

This prevents forward zones from providing bogus data.

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index ac94aa7fb493204866c7ce236492f37fef7d3344..f5e186e9dbee09c1e4c76fae0fae1e8f205d234b 100644 (file)
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -2264,7 +2264,7 @@ bool SyncRes::processRecords(const std::string& prefix, const DNSName& qname, co
       */
       if(!wasVariable() && newtarget.empty()) {
         t_sstorage.negcache.add(ne);
-        if(s_rootNXTrust && ne.d_auth.isRoot() && auth.isRoot()) {
+        if(s_rootNXTrust && ne.d_auth.isRoot() && auth.isRoot() && lwr.d_aabit) {
           ne.d_name = ne.d_name.getLastLabel();
           t_sstorage.negcache.add(ne);
         }