From be87d89e6afeebaa10aaa143f2d578565ae00f26 Mon Sep 17 00:00:00 2001
From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Fri, 23 Jun 2017 16:13:12 +0200
Subject: [PATCH] rec: Accept NXD denial state instead of NXQ for an empty
 non-terminal

---
 pdns/syncres.cc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 4ec365d4e1..5899578fc9 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -1834,6 +1834,10 @@ void SyncRes::getDenialValidationState(NegCache::NegCacheEntry& ne, vState& stat
         LOG(d_prefix<<"Insecure denial found for "<<ne.d_name<<", retuning Insecure"<<endl);
         ne.d_validationState = Insecure;
       }
+      if (res == NXDOMAIN && expectedState == NXQTYPE) {
+        /* might happen for empty non-terminal, have fun */
+        return;
+      }
       else {
         LOG(d_prefix<<"Invalid denial found for "<<ne.d_name<<", retuning Bogus"<<endl);
         ne.d_validationState = Bogus;
-- 
2.47.2