rec: Accept NXD denial state instead of NXQ for an empty non-terminal

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 4ec365d4e153d4fc165fc3541cb185a858960018..5899578fc9c5e375178a89e303db8f86dcd1d459 100644 (file)
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -1834,6 +1834,10 @@ void SyncRes::getDenialValidationState(NegCache::NegCacheEntry& ne, vState& stat
         LOG(d_prefix<<"Insecure denial found for "<<ne.d_name<<", retuning Insecure"<<endl);
         ne.d_validationState = Insecure;
       }
+      if (res == NXDOMAIN && expectedState == NXQTYPE) {
+        /* might happen for empty non-terminal, have fun */
+        return;
+      }
       else {
         LOG(d_prefix<<"Invalid denial found for "<<ne.d_name<<", retuning Bogus"<<endl);
         ne.d_validationState = Bogus;