Handle SERVFAIL replies when looking for proven-nonexistence of DS.

src/forward.c

@@ -1347,7 +1347,13 @@ static int do_check_sign(time_t now, struct dns_header *header, size_t plen, cha
 { 
   char *name_start;
   unsigned char *p;
-  int status = dnssec_validate_ds(now, header, plen, name, keyname, class);
+  int status;
+
+  /* In this case only, a SERVFAIL reply allows us to continue up the tree, looking for a 
+     suitable NSEC reply to DS queries. */
+  if (RCODE(header) != SERVFAIL)
+    { 
+      status = dnssec_validate_ds(now, header, plen, name, keyname, class);
       
       if (status != STAT_INSECURE)
 	{
@@ -1355,6 +1361,7 @@ static int do_check_sign(time_t now, struct dns_header *header, size_t plen, cha
 	    status = STAT_INSECURE;
 	  return status;
 	}
+    }
   
   p = (unsigned char *)(header+1);