zero the must-be-zero bits

diff --git a/pdns/pdns_recursor.cc b/pdns/pdns_recursor.cc
index dac86fb0c85f87a80861270b9e7af070b1c8b321..175145a1297a606de56581b477dcb41db2e80473 100644 (file)
--- a/pdns/pdns_recursor.cc
+++ b/pdns/pdns_recursor.cc
@@ -1294,7 +1294,7 @@ static void startDoResolve(void *p)
          OPT record.  This MUST also occur when a truncated response (using
          the DNS header's TC bit) is returned."
       */
-      if (addRecordToPacket(pw, makeOpt(edo.d_packetsize, 0, edo.d_Z), minTTL, dc->d_ttlCap, maxanswersize)) {
+      if (addRecordToPacket(pw, makeOpt(edo.d_packetsize, 0, edo.d_Z & EDNSOpts::DNSSECOK), minTTL, dc->d_ttlCap, maxanswersize)) {
         pw.commit();
       }
     }