fix incorrectly set AD flag for CNAME chains

Valid CNAME chains that ended in NODATA had AD flag set.
6 jobs for ad-cname-chains
in 76 minutes and 11 seconds and was queued for 1 second