From c03df9bb6f8cd71a67ef9505fcafa27d514a68ad Mon Sep 17 00:00:00 2001
From: Otto <otto.moerbeek@open-xchange.com>
Date: Wed, 11 Aug 2021 13:14:37 +0200
Subject: [PATCH] If we get an NS from the cache, it still could be one
 forwarding applies to. Take that into acount when determining dont-query
 status. Should fix #10638.

---
 pdns/syncres.cc | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 86ee77ae5b..1d51487c98 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -2373,9 +2373,17 @@ bool SyncRes::throttledOrBlocked(const std::string& prefix, const ComboAddress&
     return true;
   }
   else if(!pierceDontQuery && s_dontQuery && s_dontQuery->match(&remoteIP)) {
-    LOG(prefix<<qname<<": not sending query to " << remoteIP.toString() << ", blocked by 'dont-query' setting" << endl);
-    s_dontqueries++;
-    return true;
+    // We could have retrieved an NS from the cache in a forwarding domain
+    // Even in the case of !pierceDontQuery we still want to allow that NS
+    DNSName forwardCandidate(qname);
+    auto it = getBestAuthZone(&forwardCandidate);
+    if (it == t_sstorage.domainmap->end()) {
+      LOG(prefix<<qname<<": not sending query to " << remoteIP.toString() << ", blocked by 'dont-query' setting" << endl);
+      s_dontqueries++;
+      return true;
+    } else {
+      LOG(prefix<<qname<<": sending query to " << remoteIP.toString() << ", blocked by 'dont-query' but a forwarding/auth case" << endl);
+    }
   }
   return false;
 }
-- 
2.47.2