From: Alessio Podda <alessio@isc.org>
Date: Thu, 18 Jun 2026 12:48:39 +0000 (+0000)
Subject: fix: usr: Reject external referrals from forwarders
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a75146cdbaced3d22824ae852406ec89d9aa9d4f;p=thirdparty%2Fbind9.git

fix: usr: Reject external referrals from forwarders

Under `forward-first` policy in a forwarding zone BIND could accept NS above the forward zone apex from negative responses. This has been fixed.

ISC would like to thank Qifan Zhang, of Palo Alto Networks, for the report.

Closes #5937

Merge branch '5937-fix-forward-first-referral-bailiwick-v2' into 'main'

See merge request isc-projects/bind9!12154
---

a75146cdbaced3d22824ae852406ec89d9aa9d4f