From 2aef181efd456396791d821e8f2660c3f0f7e244 Mon Sep 17 00:00:00 2001
From: Otto <otto.moerbeek@open-xchange.com>
Date: Wed, 18 Aug 2021 09:24:45 +0200
Subject: [PATCH] Also check if the remoteIP is one of the IPs we would have
 forwarded to, even if it's coming from the cache.

---
 pdns/syncres.cc | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 1d8bdaa117..b4e064faae 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -2309,7 +2309,15 @@ bool SyncRes::throttledOrBlocked(const std::string& prefix, const ComboAddress&
       s_dontqueries++;
       return true;
     } else {
-      LOG(prefix<<qname<<": sending query to " << remoteIP.toString() << ", blocked by 'dont-query' but a forwarding/auth case" << endl);
+      // The name (from the cache) is forwarded, but is it forwarded to an IP in known forwarders?
+      const auto& ips = it->second.d_servers;
+      if (std::find(ips.cbegin(), ips.cend(), remoteIP) == ips.cend()) {
+        LOG(prefix<<qname<<": not sending query to " << remoteIP.toString() << ", blocked by 'dont-query' setting" << endl);
+        s_dontqueries++;
+        return true;
+      } else {
+        LOG(prefix<<qname<<": sending query to " << remoteIP.toString() << ", blocked by 'dont-query' but a forwarding/auth case" << endl);
+      }
     }
   }
   return false;
-- 
2.47.2