layer/validate: don't try to find proof of DS non-existence in CNAME'ed answer for...

diff --git a/lib/layer/validate.c b/lib/layer/validate.c
index 9b9b43d24d71976a69e1f8fa27828294784f30c4..95be15ef58d03716dac457c34554b704d0c30ac3 100644 (file)
--- a/lib/layer/validate.c
+++ b/lib/layer/validate.c
@@ -330,7 +330,8 @@ static int update_delegation(struct kr_request *req, struct kr_query *qry, knot_
        unsigned section = KNOT_ANSWER;
        if (!knot_wire_get_aa(answer->wire)) { /* Referral */
                section = KNOT_AUTHORITY;
-       } else if (knot_pkt_qtype(answer) == KNOT_RRTYPE_DS) { /* Subrequest */
+       } else if (knot_pkt_qtype(answer) == KNOT_RRTYPE_DS &&
+                  !(qry->flags & QUERY_CNAME)) {
                section = KNOT_ANSWER;
        } else { /* N/A */
                return kr_ok();