Also return REFUSED and not SERVFAIL when out of memory.

Thanks to Allain Legacy for problem report.

Thanks to Matthias Anfree for spotting this.

server=/example.com/<ip-of-server>

The rationale is that the chain-of-trust will not be complete to
private servers. If it was, it would not be necessary to access the
server direct.

Thanks to Michał Kępień for spotting this.

A zone which has at least one key with an algorithm we don't
support should be considered as insecure.