From c90d822bc8b7d13bf67eb46df8e84dade3fffe85 Mon Sep 17 00:00:00 2001
From: Kees Monshouwer <mind04@monshouwer.org>
Date: Mon, 9 Sep 2013 21:30:28 +0200
Subject: [PATCH] pdnssec check-all-zones now detect RRSIG records in
 non-presigned zones

---
 pdns/pdnssec.cc | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/pdns/pdnssec.cc b/pdns/pdnssec.cc
index a8f98e05d3..75d628bfd8 100644
--- a/pdns/pdnssec.cc
+++ b/pdns/pdnssec.cc
@@ -356,15 +356,18 @@ int checkZone(DNSSECKeeper &dk, UeberBackend &B, const std::string& zone)
     if (rr.qtype.getCode() == QType::CNAME) {
       if (!cnames.count(rr.qname))
         cnames.insert(rr.qname);
-      else
-      {
+      else {
         cout<<"[Error] Duplicate CNAME found at '"<<rr.qname<<"'. These do not belong in the database."<<endl;
         numerrors++;
         continue;
       }
-    }
-    else {
-      if (rr.qtype.getCode() != QType::RRSIG)
+    } else {
+      if (rr.qtype.getCode() == QType::RRSIG) {
+        if(!dk.isPresigned(zone)) {
+          cout<<"[Error] RRSIG found at '"<<rr.qname<<"' in non-presigned zone. These do not belong in the database."<<endl;
+          numerrors++;
+        }
+      } else
         noncnames.insert(rr.qname);
     }
 
@@ -389,8 +392,8 @@ int checkZone(DNSSECKeeper &dk, UeberBackend &B, const std::string& zone)
         }
         else
         {
-          cout<<"[Error] DNSKEY in non-presigned zone will mostly be ignored and can cause problems."<<endl;
-          numerrors++;
+          cout<<"[Warning] DNSKEY at '"<<rr.qname<<"' in non-presigned zone will mostly be ignored and can cause problems."<<endl;
+          numwarnings++;
         }
       }
     }
-- 
2.47.3