reduce breakage for insecure domains

Send DS queries to parent side of zone cut instead of child

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 9659966858b0f76a3d102efc7b788ad37288efe9..5b3321bdaccdc2559f23adc86318f0597f50be75 100644 (file)
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -430,6 +430,7 @@ int SyncRes::doResolve(const DNSName &qname, const QType &qtype, vector<DNSRecor
   LOG(prefix<<qname.toString()<<": No cache hit for '"<<qname.toString()<<"|"<<qtype.getName()<<"', trying to find an appropriate NS record"<<endl);
 
   DNSName subdomain(qname);
+  if(qtype == QType::DS) subdomain.chopOff();
 
   set<DNSName> nsset;
   bool flawedNSSet=false;