From 43c04e77cd202cbfccce5dde84252b836e9564f0 Mon Sep 17 00:00:00 2001
From: Pieter Lexis <pieter.lexis@powerdns.com>
Date: Fri, 21 Oct 2016 12:48:10 +0200
Subject: [PATCH] Add an RFC quote in the right place

---
 pdns/validate.cc | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pdns/validate.cc b/pdns/validate.cc
index 3445baf979..2c78123c77 100644
--- a/pdns/validate.cc
+++ b/pdns/validate.cc
@@ -69,6 +69,13 @@ static dState getDenial(const cspmap_t &validrrsets, const DNSName& qname, const
         // If the name exists, check if the qtype is denied
         if(beginHash == h && !nsec3->d_set.count(qtype)) {
           LOG("Denies existence of type "<<QType(qtype).getName()<<" for name "<<qname<<"  (not opt-out).");
+          /*
+           * RFC 5155 section 8.9:
+           * If there is an NSEC3 RR present in the response that matches the
+           * delegation name, then the validator MUST ensure that the NS bit is
+           * set and that the DS bit is not set in the Type Bit Maps field of the
+           * NSEC3 RR.
+           */
           if (qtype == QType::DS && !nsec3->d_set.count(QType::NS)) {
             LOG("However, no NS record exists at this level!"<<endl);
             return INSECURE;
-- 
2.47.2