From 3bcfe21b113abcbe37549b7ff5fbf9612f463e14 Mon Sep 17 00:00:00 2001
From: Miod Vallat <miod.vallat@powerdns.com>
Date: Fri, 19 Dec 2025 11:05:11 +0100
Subject: [PATCH] Slightly smarter DNSSEC cache purge logic.

Signed-off-by: Miod Vallat <miod.vallat@powerdns.com>
---
 pdns/dynhandler.cc | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/pdns/dynhandler.cc b/pdns/dynhandler.cc
index 8403e6f732..fac61e53de 100644
--- a/pdns/dynhandler.cc
+++ b/pdns/dynhandler.cc
@@ -133,20 +133,29 @@ string DLPurgeHandler(const vector<string>& parts, Utility::pid_t /* ppid */)
 {
   ostringstream os;
   int ret=0;
+  bool clearAllDNSSECcaches{false};
 
   if(parts.size()>1) {
     for (vector<string>::const_iterator i=++parts.begin();i<parts.end();++i) {
       g_log<<Logger::Warning<<"Cache clear request for '"<<*i<<"' received from operator"<<endl;
       ret+=purgeAuthCaches(*i);
-      if(!boost::ends_with(*i, "$"))
-        DNSSECKeeper::clearCaches(ZoneName(*i));
-      else
-        DNSSECKeeper::clearAllCaches(); // at least we do what we promise.. and a bit more!
+      if (!boost::ends_with(*i, "$")) {
+        if (!clearAllDNSSECcaches) {
+          DNSSECKeeper::clearCaches(ZoneName(*i));
+        }
+      }
+      else {
+        clearAllDNSSECcaches = true; // at least we do what we promise.. and a bit more!
+      }
     }
   }
   else {
     g_log<<Logger::Warning<<"Cache clear request received from operator"<<endl;
     ret = purgeAuthCaches();
+    clearAllDNSSECcaches = true;
+  }
+
+  if (clearAllDNSSECcaches) {
     DNSSECKeeper::clearAllCaches();
   }
 
-- 
2.47.3