From 0b1df3315428aed45b24fbac42d9c5fdabe23f57 Mon Sep 17 00:00:00 2001
From: bert hubert <bert.hubert@netherlabs.nl>
Date: Fri, 1 Jul 2016 15:50:03 +0200
Subject: [PATCH] fix up arpa/com.co insecure delegations

---
 pdns/validate.cc | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pdns/validate.cc b/pdns/validate.cc
index b5e126d5f7..38a7be2577 100644
--- a/pdns/validate.cc
+++ b/pdns/validate.cc
@@ -388,8 +388,12 @@ vState getKeysFor(DNSRecordOracle& dro, const DNSName& zone, keyset_t &keyset)
               if(nsec) {
                 if(v.first.first == qname && !nsec->d_set.count(QType::DS))
                   return Insecure;
+                else if(v.first.first < qname && qname < nsec->d_next ) {
+                  LOG("Did not find DS for this level, trying one lower"<<endl);
+                  goto skipLevel;
+                }
                 else {
-                  LOG("Did not deny existence of DS, "<<v.first.first<<"?="<<qname<<", "<<nsec->d_set.count(QType::DS)<<endl);
+                  LOG("Did not deny existence of DS, "<<v.first.first<<"?="<<qname<<", "<<nsec->d_set.count(QType::DS)<<", next: "<<nsec->d_next<<endl);
                 }
               }
             }
@@ -442,6 +446,7 @@ vState getKeysFor(DNSRecordOracle& dro, const DNSName& zone, keyset_t &keyset)
         dState dres = getDenial(validrrsets, qname, QType::DS);
         if(dres == INSECURE) return Insecure;
       }
+    skipLevel:;
     } while(!dsmap.size() && labels.size());
 
     // break;
-- 
2.47.2