312153
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
312153
index 5ef2dd6..1b987dd 100644
312153
--- a/lib/dns/resolver.c
312153
+++ b/lib/dns/resolver.c
312153
@@ -526,7 +526,9 @@ valcreate(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, dns_name_t *name,
312153
 	valarg->addrinfo = addrinfo;
312153
 
312153
 	if (!ISC_LIST_EMPTY(fctx->validators))
312153
-		INSIST((valoptions & DNS_VALIDATOR_DEFER) != 0);
312153
+		valoptions |= DNS_VALIDATOR_DEFER;
312153
+	else
312153
+		valoptions &= ~DNS_VALIDATOR_DEFER;
312153
 
312153
 	result = dns_validator_create(fctx->res->view, name, type, rdataset,
312153
 				      sigrdataset, fctx->rmessage,
312153
@@ -4872,13 +4874,6 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
312153
 							   rdataset,
312153
 							   sigrdataset,
312153
 							   valoptions, task);
312153
-					/*
312153
-					 * Defer any further validations.
312153
-					 * This prevents multiple validators
312153
-					 * from manipulating fctx->rmessage
312153
-					 * simultaneously.
312153
-					 */
312153
-					valoptions |= DNS_VALIDATOR_DEFER;
312153
 				}
312153
 			} else if (CHAINING(rdataset)) {
312153
 				if (rdataset->type == dns_rdatatype_cname)
312153
@@ -4984,6 +4979,11 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
312153
 				       eresult == DNS_R_NCACHENXRRSET);
312153
 			}
312153
 			event->result = eresult;
312153
+			if (adbp != NULL && *adbp != NULL) {
312153
+				if (anodep != NULL && *anodep != NULL)
312153
+					dns_db_detachnode(*adbp, anodep);
312153
+				dns_db_detach(adbp);
312153
+			}
312153
 			dns_db_attach(fctx->cache, adbp);
312153
 			dns_db_transfernode(fctx->cache, &node, anodep);
312153
 			clone_results(fctx);
312153
@@ -5231,6 +5231,11 @@ ncache_message(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
312153
 		fctx->attributes |= FCTX_ATTR_HAVEANSWER;
312153
 		if (event != NULL) {
312153
 			event->result = eresult;
312153
+			if (adbp != NULL && *adbp != NULL) {
312153
+				if (anodep != NULL && *anodep != NULL)
312153
+					dns_db_detachnode(*adbp, anodep);
312153
+				dns_db_detach(adbp);
312153
+			}
312153
 			dns_db_attach(fctx->cache, adbp);
312153
 			dns_db_transfernode(fctx->cache, &node, anodep);
312153
 			clone_results(fctx);
312153
@@ -6039,13 +6044,15 @@ static isc_result_t
312153
 answer_response(fetchctx_t *fctx) {
312153
 	isc_result_t result;
312153
 	dns_message_t *message;
312153
-	dns_name_t *name, *dname = NULL, *qname, tname, *ns_name;
312153
+	dns_name_t *name, *dname = NULL, *qname, *dqname, tname, *ns_name;
312153
+	dns_name_t *cname = NULL;
312153
 	dns_rdataset_t *rdataset, *ns_rdataset;
312153
 	isc_boolean_t done, external, chaining, aa, found, want_chaining;
312153
-	isc_boolean_t have_answer, found_cname, found_type, wanted_chaining;
312153
+	isc_boolean_t have_answer, found_cname, found_dname, found_type;
312153
+	isc_boolean_t wanted_chaining;
312153
 	unsigned int aflag;
312153
 	dns_rdatatype_t type;
312153
-	dns_fixedname_t fdname, fqname;
312153
+	dns_fixedname_t fdname, fqname, fqdname;
312153
 	dns_view_t *view;
312153
 
312153
 	FCTXTRACE("answer_response");
312153
@@ -6059,6 +6066,7 @@ answer_response(fetchctx_t *fctx) {
312153
 
312153
 	done = ISC_FALSE;
312153
 	found_cname = ISC_FALSE;
312153
+	found_dname = ISC_FALSE;
312153
 	found_type = ISC_FALSE;
312153
 	chaining = ISC_FALSE;
312153
 	have_answer = ISC_FALSE;
312153
@@ -6068,12 +6076,13 @@ answer_response(fetchctx_t *fctx) {
312153
 		aa = ISC_TRUE;
312153
 	else
312153
 		aa = ISC_FALSE;
312153
-	qname = &fctx->name;
312153
+	dqname = qname = &fctx->name;
312153
 	type = fctx->type;
312153
 	view = fctx->res->view;
312153
+	dns_fixedname_init(&fqdname);
312153
 	result = dns_message_firstname(message, DNS_SECTION_ANSWER);
312153
 	while (!done && result == ISC_R_SUCCESS) {
312153
-		dns_namereln_t namereln;
312153
+		dns_namereln_t namereln, dnamereln;
312153
 		int order;
312153
 		unsigned int nlabels;
312153
 
312153
@@ -6081,6 +6090,8 @@ answer_response(fetchctx_t *fctx) {
312153
 		dns_message_currentname(message, DNS_SECTION_ANSWER, &name);
312153
 		external = ISC_TF(!dns_name_issubdomain(name, &fctx->domain));
312153
 		namereln = dns_name_fullcompare(qname, name, &order, &nlabels);
312153
+		dnamereln = dns_name_fullcompare(dqname, name, &order,
312153
+						 &nlabels);
312153
 		if (namereln == dns_namereln_equal) {
312153
 			wanted_chaining = ISC_FALSE;
312153
 			for (rdataset = ISC_LIST_HEAD(name->list);
312153
@@ -6205,9 +6216,16 @@ answer_response(fetchctx_t *fctx) {
312153
 						 * a CNAME or DNAME).
312153
 						 */
312153
 						INSIST(!external);
312153
-						if (aflag ==
312153
-						    DNS_RDATASETATTR_ANSWER) {
312153
+						if ((rdataset->type !=
312153
+						     dns_rdatatype_cname) ||
312153
+						    !found_dname ||
312153
+						    (aflag ==
312153
+						     DNS_RDATASETATTR_ANSWER))
312153
+						{
312153
 							have_answer = ISC_TRUE;
312153
+							if (rdataset->type ==
312153
+							    dns_rdatatype_cname)
312153
+								cname = name;
312153
 							name->attributes |=
312153
 								DNS_NAMEATTR_ANSWER;
312153
 						}
312153
@@ -6303,11 +6321,11 @@ answer_response(fetchctx_t *fctx) {
312153
 					return (DNS_R_FORMERR);
312153
 				}
312153
 
312153
-				if (namereln != dns_namereln_subdomain) {
312153
+				if (dnamereln != dns_namereln_subdomain) {
312153
 					char qbuf[DNS_NAME_FORMATSIZE];
312153
 					char obuf[DNS_NAME_FORMATSIZE];
312153
 
312153
-					dns_name_format(qname, qbuf,
312153
+					dns_name_format(dqname, qbuf,
312153
 							sizeof(qbuf));
312153
 					dns_name_format(name, obuf,
312153
 							sizeof(obuf));
312153
@@ -6322,7 +6340,7 @@ answer_response(fetchctx_t *fctx) {
312153
 					want_chaining = ISC_TRUE;
312153
 					POST(want_chaining);
312153
 					aflag = DNS_RDATASETATTR_ANSWER;
312153
-					result = dname_target(rdataset, qname,
312153
+					result = dname_target(rdataset, dqname,
312153
 							      nlabels, &fdname);
312153
 					if (result == ISC_R_NOSPACE) {
312153
 						/*
312153
@@ -6339,10 +6357,13 @@ answer_response(fetchctx_t *fctx) {
312153
 
312153
 					dname = dns_fixedname_name(&fdname);
312153
 					if (!is_answertarget_allowed(view,
312153
-							qname, rdataset->type,
312153
-							dname, &fctx->domain)) {
312153
+						     dqname, rdataset->type,
312153
+						     dname, &fctx->domain))
312153
+					{
312153
 						return (DNS_R_SERVFAIL);
312153
 					}
312153
+					dqname = dns_fixedname_name(&fqdname);
312153
+					dns_name_copy(dname, dqname, NULL);
312153
 				} else {
312153
 					/*
312153
 					 * We've found a signature that
312153
@@ -6367,6 +6388,10 @@ answer_response(fetchctx_t *fctx) {
312153
 					INSIST(!external);
312153
 					if (aflag == DNS_RDATASETATTR_ANSWER) {
312153
 						have_answer = ISC_TRUE;
312153
+						found_dname = ISC_TRUE;
312153
+						if (cname != NULL)
312153
+							cname->attributes &=
312153
+							   ~DNS_NAMEATTR_ANSWER;
312153
 						name->attributes |=
312153
 							DNS_NAMEATTR_ANSWER;
312153
 					}