From 7aca3d413bdee0d94aae5bf2f1058cefb3ea5db8 Mon Sep 17 00:00:00 2001
From: Otto <otto.moerbeek@open-xchange.com>
Date: Wed, 18 Aug 2021 09:24:45 +0200
Subject: [PATCH] Also check if the remoteIP is one of the IPs we would have
 forwarded to, even if it's coming from the cache.

---
 pdns/syncres.cc | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 1d51487c98..d55436b9f4 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -2382,7 +2382,15 @@ bool SyncRes::throttledOrBlocked(const std::string& prefix, const ComboAddress&
       s_dontqueries++;
       return true;
     } else {
-      LOG(prefix<<qname<<": sending query to " << remoteIP.toString() << ", blocked by 'dont-query' but a forwarding/auth case" << endl);
+      // The name (from the cache) is forwarded, but is it forwarded to an IP in known forwarders?
+      const auto& ips = it->second.d_servers;
+      if (std::find(ips.cbegin(), ips.cend(), remoteIP) == ips.cend()) {
+        LOG(prefix<<qname<<": not sending query to " << remoteIP.toString() << ", blocked by 'dont-query' setting" << endl);
+        s_dontqueries++;
+        return true;
+      } else {
+        LOG(prefix<<qname<<": sending query to " << remoteIP.toString() << ", blocked by 'dont-query' but a forwarding/auth case" << endl);
+      }
     }
   }
   return false;
-- 
2.47.3