From: Evan Hunt <each@isc.org>
Date: Thu, 2 Jul 2026 07:44:53 +0000 (+0000)
Subject: fix: usr: Don't evict DNSSEC-validated cache data on a CD=1 NXDOMAIN
X-Git-Tag: v9.21.24~34
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=84556763a487b7cc2d456f4b028783d7473730a2;p=thirdparty%2Fbind9.git

fix: usr: Don't evict DNSSEC-validated cache data on a CD=1 NXDOMAIN

When a client sent a query with the checking-disabled (CD) bit set and the
answer was NXDOMAIN, the resolver cached that unvalidated negative response and
discarded any DNSSEC-validated records it already held for the same name, even
though the validated data was more trustworthy. A single such response -
including a forged one - could flush validated records from the cache and force
the resolver to fetch them again. The resolver now checks the trust level of the
existing data first and leaves the cache unchanged when it is already validated.

Closes #5877

Merge branch '5877-cd-nxdomain' into 'main'

See merge request isc-projects/bind9!11946
---

84556763a487b7cc2d456f4b028783d7473730a2