[2226] Return rcode=REFUSED to serve qtype=RRSIG queries

diff --git a/src/bin/auth/query.cc b/src/bin/auth/query.cc
index 87f8e91cdb72cfa967cf8d3a37e465c2ef1dab38..befa458d2a532f7a16700c3ecc0cd53b89357d6e 100644 (file)
--- a/src/bin/auth/query.cc
+++ b/src/bin/auth/query.cc
@@ -393,6 +393,17 @@ Query::process(datasrc::ClientList& client_list,
         response_->setRcode(Rcode::SERVFAIL());
         return;
     }
+
+    if (qtype == RRType::RRSIG()) {
+        // We will not serve RRSIGs directly. See #2226 and the
+        // following thread for discussion why:
+        // http://www.ietf.org/mail-archive/web/dnsext/current/msg07123.html
+        // RRSIGs go together with their covered RRset.
+        response_->setHeaderFlag(Message::HEADERFLAG_AA);
+        response_->setRcode(Rcode::REFUSED());
+        return;
+    }
+
     ZoneFinder& zfinder = *result.finder_;
 
     // We have authority for a zone that contain the query name (possibly