From 8469ee3726540781cf3b13db24bf5df9ee12fdc3 Mon Sep 17 00:00:00 2001
From: Brian Wellington <source@isc.org>
Date: Tue, 11 Apr 2000 18:43:27 +0000
Subject: [PATCH] Don't include authority data if it would force us to unset
 the AD bit

---
 bin/named/query.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/bin/named/query.c b/bin/named/query.c
index 853c39cfc1..503e4eca96 100644
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -1581,6 +1581,10 @@ query_addbestns(ns_client_t *client) {
 		zsigrdataset = NULL;
 	}
 
+	if ((client->message->flags & DNS_MESSAGEFLAG_CD) == 0 &&
+	    rdataset->trust == dns_trust_pending)
+		goto cleanup;
+
 	query_addrrset(client, &fname, &rdataset, &sigrdataset, dbuf,
 		       DNS_SECTION_AUTHORITY);