When following a CNAME chain, if any lookup is insecure the whole must be too

1 files changed, 13 insertions, 1 deletions

diff --git a/src/src/dns.c b/src/src/dns.c
index ac52e5621..542354db3 100644
--- a/src/src/dns.c
+++ b/src/src/dns.c
@@ -455,6 +455,14 @@ return h->ad ? TRUE : FALSE;
 #endif
 }
 
+static void
+dns_set_insecure(dns_answer * dnsa)
+{
+HEADER * h = (HEADER *)dnsa->answer;
+h->ad = 0;
+}
+
+
 
 
 
@@ -752,7 +760,8 @@ int
 dns_lookup(dns_answer *dnsa, uschar *name, int type, uschar **fully_qualified_name)
 {
 int i;
-uschar *orig_name = name;
+const uschar *orig_name = name;
+BOOL secure_so_far = TRUE;
 
 /* Loop to follow CNAME chains so far, but no further... */
 
@@ -825,6 +834,9 @@ for (i = 0; i < 10; i++)
   if (datalen < 0) return DNS_FAIL;
   name = data;
 
+  if (!dns_is_secure(dnsa))
+    secure_so_far = FALSE;
+
   DEBUG(D_dns) debug_printf("CNAME found: change to %s\n", name);
   }       /* Loop back to do another lookup */