the presence of a DNAME record proves that the name does not exist in the zone but...

diff --git a/lib/dns/include/dns/nsec.h b/lib/dns/include/dns/nsec.h
index da1d5d695a573aced97e5d0e4baf133fcb8fd61b..623dfb70a881b89500865817a67c3b3b33361189 100644 (file)
--- a/lib/dns/include/dns/nsec.h
+++ b/lib/dns/include/dns/nsec.h
@@ -101,6 +101,9 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
  * or we can determine whether there is data or not at the name.
  * If the name does not exist return the wildcard name.
  *
+ * Return DNS_R_DNAME when the NSEC indicates that name is covered by
+ * a DNAME.  'wild' is not set in this case.
+ *
  * Return ISC_R_IGNORE when the NSEC is not the appropriate one.
  */
 

diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c
index 991391b7a6f6bfb702a8c9af1f5d2ead5f85c635..ad081d89fca3412b5c7bd68972fc291e76ed19f1 100644 (file)
--- a/lib/dns/nsec.c
+++ b/lib/dns/nsec.c
@@ -374,8 +374,7 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
        }
 
        if (relation == dns_namereln_subdomain &&
-           (dns_nsec_typepresent(&rdata, dns_rdatatype_dname) ||
-            dns_nsec_typepresent(&rdata, dns_rdatatype_ns)) &&
+           dns_nsec_typepresent(&rdata, dns_rdatatype_ns) &&
            !dns_nsec_typepresent(&rdata, dns_rdatatype_soa))
        {
                /*
@@ -388,6 +387,15 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
                return (ISC_R_IGNORE);
        }
 
+       if (relation == dns_namereln_subdomain &&
+           dns_nsec_typepresent(&rdata, dns_rdatatype_dname))
+       {
+               (*logit)(arg, ISC_LOG_DEBUG(3),
+                        "nsec proves covered by dname");
+               *exists = ISC_FALSE;
+               return (DNS_R_DNAME);
+       }
+
        result = dns_rdata_tostruct(&rdata, &nsec, NULL);
        if (result != ISC_R_SUCCESS)
                return (result);