Edge case: DS under CNAME
Example:
$ kdig www.ietf.org DS
;; ->>HEADER<<- opcode: QUERY; status: SERVFAIL; id: 51110
;; Flags: qr rd ra; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 0
;; QUESTION SECTION:
;; www.ietf.org. IN DS
;; ANSWER SECTION:
www.ietf.org. 1800 IN CNAME www.ietf.org.cdn.cloudflare.net.
kresd attempts to prove non-existence of DS www.ietf.org.cdn.cloudflare.net.
, but that's wrong due to DS
being parent-centric. The correct answer would be with NOERROR
and AD
flag but otherwise the same.