Inhibit DNSSEC validation when forwarding to private servers for a domain.
server=/example.com/<ip-of-server>
The rationale is that the chain-of-trust will not be complete to
private servers. If it was, it would not be necessary to access the
server direct.
diff --git a/src/forward.c b/src/forward.c
index 47c6ded..1458578 100644
--- a/src/forward.c
+++ b/src/forward.c
@@ -406,7 +406,7 @@
}
#ifdef HAVE_DNSSEC
- if (option_bool(OPT_DNSSEC_VALID))
+ if (option_bool(OPT_DNSSEC_VALID) && !(type & SERV_HAS_DOMAIN))
{
size_t new = add_do_bit(header, plen, ((unsigned char *) header) + PACKETSZ);
@@ -858,7 +858,8 @@
no_cache_dnssec = 1;
#ifdef HAVE_DNSSEC
- if (server && option_bool(OPT_DNSSEC_VALID) && !(forward->flags & FREC_CHECKING_DISABLED))
+ if (server && !(server->flags & SERV_HAS_DOMAIN) &&
+ option_bool(OPT_DNSSEC_VALID) && !(forward->flags & FREC_CHECKING_DISABLED))
{
int status = 0;