limit mode 0 closest provable encloser to optout

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 39fe8d7a2d02985ef6a90ca936656eea77166d55..12760ec8b025dc065095cb2feec4035fc02c72ce 100644 (file)
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -607,7 +607,7 @@ void PacketHandler::addNSEC3(DNSPacket *p, DNSPacket *r, const string& target, c
 
     getNSEC3Hashes(narrow, sd.db, sd.domain_id,  hashed, false, unhashed, before, after, mode);
 
-    if ((mode == 0 ||  mode == 1) && (hashed != before)) {
+    if (((mode == 0 && ns3rc.d_flags) ||  mode == 1) && (hashed != before)) {
       DLOG(L<<"No matching NSEC3, do closest (provable) encloser"<<endl);
 
       bool doBreak = false;