Jan Včelák
--- a/src/knot/nameserver/nsec_proofs.c
+++ b/src/knot/nameserver/nsec_proofs.c
+static bool wildcard_expanded(const zone_node_t *node, const knot_dname_t *qname)
 {
-	int ce_labels = knot_dname_labels(closest_encloser, NULL);
-	int qname_labels = knot_dname_labels(name, NULL);
-
-	// the common labels should match
-	assert(knot_dname_matched_labels(closest_encloser, name) == ce_labels);
+	return !knot_dname_is_wildcard(qname) && knot_dname_is_wildcard(node->owner);
+}

-	// chop some labels from the qname
-	for (int i = 0; i < (qname_labels - ce_labels - 1); ++i) {
-		name = knot_wire_next_label(name, NULL);
-	}
+/*!
+ * \brief Check if out-out can take an effect.
--- a/src/knot/nameserver/nsec_proofs.c
+++ b/src/knot/nameserver/nsec_proofs.c
+ * \see https://tools.ietf.org/html/rfc5155#section-7.2.2
 *
- * \retval KNOT_EOK
- * \retval NS_ERR_SERVFAIL
+ * \param qname    Source QNAME.
+ * \param zone     Source zone.
+ * \param closest  Closest matching parent of \a qname.
+ * \param qdata    Query processing data.
+ * \param resp     Response packet.
+ *
+ * \retval KNOT_E*
 */
-static int put_nsec3_nxdomain(const zone_contents_t *zone,
-                              const zone_node_t *closest_encloser,
-                              const knot_dname_t *qname,
+static int put_nsec3_nxdomain(const knot_dname_t *qname,