RPZ now treats covering NSEC records the same as negative answers

(cherry picked from commit 9407d9e266b0b5c5833c1449ef4316987a7e1b67)

diff --git a/lib/ns/query.c b/lib/ns/query.c
index 17effd7aff2ad04a0e2022e8d6e3ac1d7d8f5df2..666675290ddbca1e2a6c0efdfb2bc9d284397bb4 100644 (file)
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -3954,6 +3954,7 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype,
        case DNS_R_EMPTYWILD:
        case DNS_R_NCACHENXDOMAIN:
        case DNS_R_NCACHENXRRSET:
+       case DNS_R_COVERINGNSEC:
        case DNS_R_CNAME:
        case DNS_R_DNAME:
                qresult_type = qresult_type_restart;