From 7b20ee0d803a26082aaefd492b8413e10479e7c6 Mon Sep 17 00:00:00 2001
From: bert hubert <bert.hubert@netherlabs.nl>
Date: Sun, 28 Feb 2016 19:56:41 +0100
Subject: [PATCH] don't store empty records in the cache if we did get RRSIGs
 for a record we did not accept from an authoritative server

---
 pdns/syncres.cc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index 4332fd714..1304bd036 100644
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -1212,6 +1212,8 @@ int SyncRes::doResolveAt(map<DNSName, pair<ComboAddress, bool> > &nameservers, D
 
 	//	cout<<"Have "<<i->second.records.size()<<" records and "<<i->second.signatures.size()<<" signatures for "<<i->first.first.toString();
 	//	cout<<'|'<<DNSRecordContent::NumberToType(i->first.second.getCode())<<endl;
+        if(i->second.records.empty()) // this happens when we did store signatures, but passed on the records themselves
+          continue;
         t_RC->replace(d_now.tv_sec, i->first.name, QType(i->first.type), i->second.records, i->second.signatures, lwr.d_aabit, i->first.place == DNSResourceRecord::ANSWER ? ednsmask : boost::optional<Netmask>());
 	if(i->first.place == DNSResourceRecord::ANSWER && ednsmask)
 	  d_wasVariable=true;
-- 
2.40.0