Fix various bugs reported by valgrind --tool=memcheck (#46978) (cherry picked from commit f96133826e3f70efea237b7fe6a47a45a35a6ab0) (cherry picked from commit 0374e1c3fdc13a20648d9c9de5601ad042e6044d)

update copyright notice / whitespace

[v9_11] block validator deadlock and prevent use-after-free 4859. [bug] A loop was possible when attempting to validate unsigned CNAME responses from secure zones; this caused a delay in returning SERVFAIL and also increased the chances of encountering CVE-2017-3145. [RT #46839] 4858. [security] Addresses could be referenced after being freed in resolver.c, causing an assertion failure. (CVE-2017-3145) [RT #46839]

[v9_11] Refactor reclimit system test 4823. [test] Refactor reclimit system test to improve its reliability and speed. [RT #46632] (cherry picked from commit 6035d557c4e7be15a08f3905b978af566946def9)

[v9_11] ignore cache when sending 5011 refresh queries 4771. [bug] When sending RFC 5011 refresh queries, disregard cached DNSKEY rrsets. [RT #46251] (cherry picked from commit b2597ce86bbd95baf56a3cf422bfd55e5d148c79)

[v9_11] reduce unnecessary priming queries 4770. [bug] Cache additional data from priming queries as glue. Previously they were ignored as unsigned non-answer data from a secure zone, and never actually got added to the cache, causing hints to be used frequently for root-server addresses, which triggered re-priming. [RT #45241] (cherry picked from commit 5de02a075b19f6781a168da7b81fc78313546c90)

tcp test got reversed (cherry picked from commit b4c31c87950aa9e173c29dce7ef8bff7ce892db0)

4739. [cleanup] Address clang static analysis warnings. [RT #45952] (cherry picked from commit f9f3f20d2d08e1c8756a1b260d7c5125426d8395)

[master] cleanup strcat/strcpy 4722. [cleanup] Clean up uses of strcpy() and strcat() in favor of strlcpy() and strlcat() for safety. [RT #45981] (cherry picked from commit 114f95089c4db619ee723e4146639700afa17b5e)

[v9_11] improve handling of qcount=0 replies 4717. [bug] Treat replies with QCOUNT=0 as truncated if TC=1, FORMERR if TC=0, and log the error correctly. [RT #45836] (cherry picked from commit 25b33bede42fc42033c7d67c9179e5a04e573ccd)

4675. [cleanup] Don't use C++ keyword class. [RT #45726]

[v9_11] silence gcc 7 warnings 4673. [port] Silence GCC 7 warnings. [RT #45592] (cherry picked from commit cdacec1dcb93149b8efc7af38ec916adcdd706f3)

add comment

style

style changes from [RT #45321] (cherry picked from commit bcb2df226ff3f1118ff3e0560f5404ec71cc4417)

Fix a race in resume_dslookup() (#45168) (cherry picked from commit c88efb83b320e428bfee9bd962fa21120844ee1a)

4654. [cleanup] Don't use C++ keywords delete, new and namespace. [RT #45538] (cherry picked from commit 4bf32aa58774452b05433716f8fa298257dd7fda)

4580. [bug] 4578 introduced a regression when handling CNAME to referral below the current domain. [RT #44850] (cherry picked from commit 638c7c635ddab0b717a675f49b1180dbf8ef803e)

Reimplement: 4578. [security] Some chaining (CNAME or DNAME) responses to upstream queries could trigger assertion failures. (CVE-2017-3137) [RT #44734] (cherry picked from commit f240f4a5decae09cdabb83f824e0fd339377ad7e)

[v9_11] remove unnecessary INSIST and prep 9.11.1rc2 4578. [security] Some chaining (CNAME or DNAME) responses to upstream queries could trigger assertion failures. (CVE-2017-3137) [RT #44734] (cherry picked from commit a1365a0042db8c1cd0ee4dbd0c91ce65ae09e098)

[v9_11] store local and remote addresses in dnstap 4569. [func] Store both local and remote addresses in dnstap logging, and modify dnstap-read output format to print them. [RT #43595] (cherry picked from commit 650b5e7592be43d6994ba425bc1fa654d538cd7e)

[v9_11] address portability issues (cherry picked from commit a2bd99a959bf84c48a5f5f71df7a2212a86db670)

[v9_11] change 4558 was incomplete (cherry picked from commit cd668ea57fc236e1f7509c3827e4a39a62078a2d)

update copyright notice / whitespace

4558. [bug] Synthesised CNAME before matching DNAME was still being cached when it should have been. [RT #44318] (cherry picked from commit 9f4bf43b79e64463103395a29d41a903bf2b8846)

4510. [security] Named mishandled some responses where covering RRSIG records are returned without the requested data resulting in a assertion failure. (CVE-2016-9147) [RT #43548] (cherry picked from commit 6adf421e7eb7cac80bc91e1e600346517e980850)

4508. [security] Named incorrectly tried to cache TKEY records which could trigger a assertion failure when there was a class mismatch. (CVE-2016-9131) [RT #43522] (cherry picked from commit 2c1c4b99a127a0f34e10fe27324d552ccbc54e04)

4517. [security] Named could mishandle authority sections that were missing RRSIGs triggering an assertion failure. (CVE-2016-9444) [RT # 43632] (cherry picked from commit 1df30cfd27c5a3c57fce357c54aaf6c702227d51)

4530. [bug] Change 4489 broke the handling of CNAME -> DNAME in responses resulting in SERVFAIL being returned. [RT #43779] (cherry picked from commit 60cb462c56536f307fac4db8bdebf1247e2b5f66)

4489. [security] It was possible to trigger assertions when processing a response. (CVE-2016-8864) [RT #43465] (cherry picked from commit bd6f27f5c353133b563fe69100b2f168c129f3ca)

9.11.0rc3

4453. [bug] Prefetching of DS records failed to update their RRSIGs. [RT #42865] (cherry picked from commit f431bf02a6d1df7eebc60dac5662b9c36098683c)

sync

4408. [func] Continue waiting for expected response when we the response we get does not match the request. [RT #41026] (cherry picked from commit ec5e01747a0b128039aba31b13616282e25fc9f8)

4403. [bug] Rename variables and arguments that shadow: basename, clone and gai_error. (cherry picked from commit ecfa005085e9f23d95d3ca1fc23211284a919423)

4401. [misc] Change LICENSE to MPL 2.0.

4358. [test] Added American Fuzzy Lop harness that allows feeding fuzzed packets into BIND. [RT #41723]

Log query and depth counters during fetches when querytrace is enabled (#41787)

silence may be used when unset false positive

Part 2 of: 4319. [security] Fix resolver assertion failure due to improper DNAME handling when parsing fetch reply messages. (CVE-2016-1286) [RT #41753]

4322. [security] Duplicate EDNS COOKIE options in a response could trigger an assertion failure. (CVE-2016-2088) [RT #41809]

Fix resolver assertion failure due to improper DNAME handling (CVE-2016-1286) (#41753)

4317. [bug] Age all unused servers on fetch timeout. [RT #41597]

4293. [bug] Address memory leak on priming query creation failure. [RT #41512]

update copyright notice / whitespace

[master] fixed bogus server regression 4288. [bug] Fixed a regression in resolver.c:possibly_mark() which caused known-bogus servers to be queried anyway. [RT #41321]

4260. [security] Insufficient testing when parsing a message allowed records with an incorrect class to be be accepted, triggering a REQUIRE failure when those records were subsequently cached. (CVE-2015-8000) [RT #4098]

4253. [bug] Address fetch context reference count handling error on socket error. [RT#40945]

4238. [bug] Don't send to servers on net zero (0.0.0.0/8). [RT #40947]

[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]

curr_srtt = curr->srtt

compare curr_srtt and best_srtt

re-organise sort to use best_srtt and curr_srtt

4222. [func] Bias IPv6 servers when selecting the next server to query. [RT #40836]

4221. [bug] Resource leak on DNS_R_NXDOMAIN in fctx_create. [RT #40583]

4212. [func] Re-query if we get a bad client cookie returned over UDP. [RT #40748]

4193. [bug] Handle broken servers that return BADVERS incorrectly. [RT #40427]

[master] address buffer accounting error 4168. [security] A buffer accounting error could trigger an assertion failure when parsing certain malformed DNSSEC keys. (CVE-2015-5722) [RT #40212]

[master] DDoS mitigation features 3938. [func] Added quotas to be used in recursive resolvers that are under high query load for names in zones whose authoritative servers are nonresponsive or are experiencing a denial of service attack. - "fetches-per-server" limits the number of simultaneous queries that can be sent to any single authoritative server. The configured value is a starting point; it is automatically adjusted downward if the server is partially or completely non-responsive. The algorithm used to adjust the quota can be configured via the "fetch-quota-params" option. - "fetches-per-zone" limits the number of simultaneous queries that can be sent for names within a single domain. (Note: Unlike "fetches-per-server", this value is not self-tuning.) - New stats counters have been added to count queries spilled due to these quotas. See the ARM for details of these options. [RT #37125]

update copyright notice / whitespace

4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are avaliable: send-cookie, cookie-secret, cookie-algorithm and nocookie-udp-size. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]

4146. [bug] Address reference leak that could prevent a clean shutdown. [RT #37125]

[master] address regression 4126. [bug] Addressed a regression introduced in change #4121. [RT #39611]

[master] use after free in resquery_destroy() 4102. [bug] Fix a use after free bug introduced in change #4094. [RT #39281]

Don't use query->sendevent after it's been destroyed (#39132)

[master] hold a reference on fetch context during query 4094. [bug] A race during shutdown or reconfiguration could cause an assertion in mem.c. [RT #38979]

4074. [cleanup] Cleaned up more warnings from gcc -Wshadow. [RT #38708]

Add a --enable-querytrace configure switch for very verbose query tracelogging (#37520)

update copyright notice / whitespace

[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]

4024. [bug] dns_rdata_opt_first, dns_rdata_opt_next, dns_rdata_opt_current, dns_rdata_txt_first, dns_rdata_txt_next and dns_rdata_txt_current were documented but not implemented. These have now been implemented. dns_rdata_spf_first, dns_rdata_spf_next and dns_rdata_spf_current were document but not implemented. The prototypes for these functions have been removed. [RT #38068] 4023. [bug] win32: socket handling with explict ports and invoking named with -4 was broken for some configurations. [RT #38068]

[master] adjust max-recursion-queries 4021. [bug] Adjust max-recursion-queries to accommodate the need for more queries when the cache is empty. [RT #38104]

4019. [func] If named is not configured to validate the answer then allow fallback to plain DNS on timeout even when we know the server supports EDNS. [RT #37978]

4015. [bug] Nameservers that are skipped due to them being CNAMEs were not being logged. They are now logged to category 'cname' as per BIND 8. [RT #37935]

Add a TCP only option to server/peer

[master] refactor max-recursion-queries - the counters weren't set correctly when fetches timed out. instead we now pass down a counter object.

[master] add max-recursion-queries also fixes and documentation for max-recursion-depth

[master] limit recursion depth and iterative queries 4006. [security] A flaw in delegation handling could be exploited to put named into an infinite loop. This has been addressed by placing limits on the number of levels of recursion named will allow (default 7), and the number of iterative queries that it will send (default 50) before terminating a recursive query (CVE-2014-8500). The recursion depth limit is configured via the "max-recursion-depth" option. [RT #35780]

3981. [bug] Cache DS/NXDOMAIN independently of other query types. [RT #37467]

3965. [func] Log outgoing packets and improve packet logging to support logging the remote address. [RT #36624]

silence compiler warning

3949. [experimental] Experimental support for draft-andrews-edns1 by sending EDNS(1) queries (define DRAFT_ANDREWS_EDNS1 when building). Add support for limiting the EDNS version advertised to servers: server { edns-version 0; }; Log the EDNS version received in the query log. [RT #35864]

3945. [bug] Invalid wildcard expansions could be incorrectly accepted by the validator. [RT #37093]

[master] servfail cache 3943. [func] SERVFAIL responses can now be cached for a limited time (configured by "servfail-ttl", default 10 seconds, limit 30). This can reduce the frequency of retries when an authoritative server is known to be failing, e.g., due to ongoing DNSSEC validation problems. [RT #21347]

complete conversion to FCTXTRACE3

[master] add better servfail logging 3937. [func] Added some debug logging to better indicate the conditions causing SERVFAILs when resolving. [RT #35538]

[master] complete change #3925 - don't use fwdname in dns_view_findzonecut()

remove redundant isc_sockaddr_format call

3912. [bug] Address some unrecoverable lookup failures. [RT #36330]

3904. [func] Add the RPZ SOA to the additional section. [RT36507]

use isc_time_seconds rather than .seconds

[master] complete NTA work 3882. [func] By default, negative trust anchors will be tested periodically to see whether data below them can be validated, and if so, they will be allowed to expire early. The "rndc nta -force" option overrides this behvaior. The default NTA lifetime and the recheck frequency can be configured by the "nta-lifetime" and "nta-recheck" options. [RT #36146]

attempt to silence leaked lock false positive

[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]

correct EDNSOK sense

3857. [bug] Make it harder for a incorrect NOEDNS classification to be made. [RT #36020]

remove unused assignment

3855. [bug] Limit smoothed round trip time aging to no more than once a second. [RT #32909]

[master] reduce EDNS logging noise 3831. [cleanup] Reduce logging noise when EDNS state changes occur. [RT #35843]

3810. [bug] Work around broken nameservers that fail to ignore unknown EDNS options. [RT #35766]

othererror should not include badvers now that we have a badvers counter

update copyright notice

only set FCTX_ADDRINFO_NOSIT if we don't have a existing sit

3790. [bug] Handle broken nameservers that send BADVERS in response to unknown EDNS options. Maintain statistics on BADVERS responses.

[master] fix memory leak

[master] printable NSID logging 3774. [func] When using "request-nsid", log the NSID value in printable form as well as hex. [RT #20864]

#ifdef notyet error handling for bad sit

adjust SIT computation

[master] assert if sitok/sitbad are insane

set setok/sitbad

s/DNS_EDNSOPTIONS/DNS_EDNSOPTIONS/

define DNS_OPT_EDNSOPTIONS

WIN32 master fixes

[master] fix dns_resolver_destroyfetch race 3747. [bug] A race condition could lead to a core dump when destroying a resolver fetch object. [RT #35385]

[master] add "--with-tuning=large" option 3745. [func] "configure --with-tuning=large" adjusts various compiled-in constants and default settings to values suited to large servers with abundant memory. [RT #29538]

3744. [experimental] SIT: send and process Source Identity Tokens (which are similar to DNS Cookies by Donald Eastlake) and are designed to help clients detect off path spoofed responses and for servers to detect legitimate clients. SIT use a experimental EDNS option code (65001). SIT can be enabled via --enable-developer or --enable-sit. It is on by default in Windows. RRL processing as been updated to know about SIT with legitimate clients not being rate limited. [RT #35389]

[master] delve 3741. [func] "delve" (domain entity lookup and validation engine): A new tool with dig-like semantics for performing DNS lookups, with internal DNSSEC validation, using the same resolver and validator logic as named. This allows easy validation of DNSSEC data in environments with untrustworthy resolvers, and assists with troubleshooting of DNSSEC problems. (Note: not yet available on win32.) [RT #32406]

update copyright notice

fix for pre C99 compiler

3703. [func] Prefetch about to expire records if they are queried for, see prefetch option for details. [RT #35041]

update copyright notice

[master] replace memcpy() with memmove(). 3698. [cleanup] Replaced all uses of memcpy() with memmove(). [RT #35120]

[master] fix insecure delegation across static-stub zones 3689. [bug] Fixed a bug causing an insecure delegation from one static-stub zone to another to fail with a broken trust chain. [RT #35081]

3681. [port] Update the Windows build system to support feature selection and WIN64 builds. This is a work in progress. [RT #34160]

missing FCTXTRACE2 macro RT#34914

add comment

[master] "flushtree -all" no longer optional Updated CHANGES note: 3606. [func] "rndc flushtree" now flushes matching records in the address database and bad cache as well as the DNS cache. (Previously only the DNS cache was flushed.) [RT #33970]

[master] "rndc flushtree -all <name>" 3606. [func] "rndc flushtree -all" flushes matching records in the ADB and bad cache as well as the DNS cache. (Without the "-all" option, flushtree will still only flush records from the DNS cache.) [RT #33970]

update copyright notice

move declaration to begining of block

3593. [func] Update EDNS processing to better track remote server capabilities. [RT #30655]

[master] assertion failure in resolver.c 3584. [security] Caching data from an incompletely signed zone could trigger an assertion failure in resolver.c [RT #33690]

3551. [bug] resolver.querydscp[46] were uninitialized. [RT #32686]

[master] unify internal and export libraries 3550. [func] Unified the internal and export versions of the BIND libraries, allowing external clients to use the same libraries as BIND. [RT #33131]

3548. [bug] The NSID request code in resolver.c was broken resulting in invalid EDNS options being sent. [RT #33153]

3541. [bug] The parts if libdns was not being properly initialized in when built in libexport mode. [RT #33028]

[master] add DSCP support 3535. [func] Add support for setting Differentiated Services Code Point (DSCP) values in named. Most configuration options which take a "port" option (e.g., listen-on, forwarders, also-notify, masters, notify-source, etc) can now also take a "dscp" option specifying a code point for use with outgoing traffic, if supported by the underlying OS. [RT #27596]

3487. [bug] Change 3444 was not complete. There was a additional place where the NOQNAME proof needed to be saved. [RT #32629] Squashed commit of the following: commit cdef844f57bd3eb30b1f77135b89b6f9360e8bee Author: Mark Andrews <marka@isc.org> Date: Sat Feb 16 00:27:14 2013 +1100 whitespace commit 60eb7e3f6cdd102d6aaf0fb4ada8c552576e4502 Author: Mark Andrews <marka@isc.org> Date: Sat Feb 16 00:19:51 2013 +1100 return noqname proof with +cd and dlv

update copyright notice

3461. [bug] Negative responses could incorrectly have AD=1 set. [RT #32237]

silence signed/unsigned warning; rename log -> fctx_log

update copyright notice

3443. [bug] The NOQNAME proof was not being returned from cached insecure responses. [RT #21409]

update copyright notice

3422. [bug] Added a clear error message for when the SOA does not match the referral. [RT #31281]

3392. [func] Keep statistics on REFUSED responses. [RT #31412]

3391. [bug] DNSKEY that encountered a CNAME failed. [RT #31262]

fix coverity issues 3388. [bug] Fixed several Coverity warnings. [RT #30996]

3387. [func] Support for a DS digest can be disabled at runtime with disable-ds-digests. [RT #21581]

3376. [bug] Lack of EDNS support was being recorded without a successful response. [RT #30811]

fix bad-cache assert 3346. [security] Bad-cache data could be used before it was initialized, causing an assert. [RT #30025]

3333. [bug] Setting resolver-query-timeout too low can cause named to not recover if it looses connectivity. [RT #29623]

Merge statistics code (ATT SoW, rt24117) This includes the following changes: 3326. [func] Added task list statistics: task model, worker threads, quantum, tasks running, tasks ready. [RT #27678] 3325. [func] Report cache statistics: memory use, number of nodes, number of hash buckets, hit and miss counts. [RT #27056] 3324. [test] Add better tests for ADB stats [RT #27057] 3323. [func] Report the number of buckets the resolver is using. [RT #27020] 3322. [func] Monitor the number of active TCP and UDP dispatches. [RT #27055] 3321. [func] Monitor the number of recursive fetches and the number of open sockets, and report these values in the statistics channel. [RT #27054] 3320. [func] Added support for monitoring of recursing client count. [RT #27009] 3319. [func] Added support for monitoring of ADB entry count and hash size. [RT #27057]

3318. [tuning] Reduce the amount of work performed while holding a bucket lock when finshed with a fetch context. [RT #29239]

Improve locking performance in dispatch.c 3316. [tuning] Improved locking performance when recursing. [RT #28836] - Use one lock per memory pool instead of associating them all with a single 'pool_lock' in the dispatch manager. - Reduce the critical sections for qid->lock in get_dispsocket(), deref_portentry() and dns_dispatch_addresponse2(). - Added a memory pool for socket events in dns_dispatch_t. - Add an isc_socketevent_t member in the resquery_t object, and use it with isc_socket_sendto2() instead of using isc_socket_sendto() - Tuned the memory pools in dispatch.c for better performance under load

create and use multiple fetch dispatches Added API to create a set of UDP dispatches which can be shared round-robin style when making upstream queries for authoritative data; this should reduce lock contention in the query source dispatch.

fctx_finddone: call fctx_destroy within the bucket lock

set $Id$

dns_message_logpacket

update copyright notice

extend: 3282. [bug] Restrict the TTL of NS RRset to no more than that of the old NS RRset when replacing it. [RT #27792] [RT #27884]

3241. [bug] Address race conditions in the resolver code. [RT #26889]

missed a line

Back out changes #3182 and #3202

3221. [bug] Fixed a potential coredump on shutdown due to referencing fetch context after it's been freed. [RT #26720]

--- 9.9.0b2 released --- 3219. [bug] Disable NOEDNS caching following a timeout.

3216. [bug] resolver.c:validated() was not thread-safe. [RT #26478]

update copyright notice

3202. [bug] NOEDNS caching on timeout was too agressive. [RT #26416]

3192. [bug] A query structure could be used after being freed. [RT #22208]

update copyright notice

fix edns0 retry issues (rt #23393/24964).

3167. [bug] Negative answers from forwarders were not being correctly tagged making them appear to not be cached. [RT #25380]

3124. [bug] Use an rdataset attribute flag to indicate negative-cache records rather than using rrtype 0; this will prevent problems when that rrtype is used in actual DNS packets. [RT #24777] 3123. [security] Change #2912 exposed a latent flaw in dns_rdataset_totext() that could cause named to crash with an assertion failure. [RT #24777]

3069. [cleanup] Silence warnings messages from clang static analysis. [RT #20256]

catch two unused function params, followup to RT#23310

Remove RTT banding [RT 23310]

update copyright notice

3011. [func] Change the default query timeout from 30 seconds to 10. Allow setting this in named.conf using the new 'resolver-query-timeout' option, which specifies a max time in seconds. 0 means 'default' and anything longer than 30 will be silently set to 30. [RT #22852]

update copyright notice

3009. [bug] clients-per-query code didn't work as expected with particular query patterns. [RT #22972]

2961. [bug] Be still more selective about the non-authoritative answers we apply change 2748 to. [RT #22074]

2930. [experimental] New "rndc addzone" and "rndc delzone" commads allow dynamic addition and deletion of zones. To enable this feature, specify a "new-zone-file" option at the view or options level in named.conf. Zone configuration information for the new zones will be written into that file. To make the new zones persist after a restart, "include" the file into named.conf in the appropriate view. (Note: This feature is not yet documented, and its syntax is expected to change.) [RT #19447]

2928. [bug] Be more selective about the non-authoritative answer we apply change 2748 to. [RT #21594]

update copyright notice

2921. [bug] The resolver could attempt to destroy a fetch context to soon. [RT #19878]

update copyright notice

2874. [bug] Cache lack of EDNS support only after the server successfully responds to the query using plain DNS. [RT #20930]

2958. [bug] When canceling validation it was possible to leak memory. [RT #20800]

2957. [bug] RTT estimates were not being adjusted on ICMP errors. [RT #20772]

update copyright notice

2852. [bug] Handle broken DNSSEC trust chains better. [RT #15619]

update copyright notice

2831. [security] Do not attempt to validate or cache out-of-bailiwick data returned with a secure answer; it must be re-fetched from its original source and validated in that context. [RT #20819]

update copyright notice

2772. [security] When validating, track whether pending data was from the additional section or not and only return it if validates as secure. [RT #20438]

update copyright notice

2770. [cleanup] Add log messages to resolver.c to indicate events causing FORMERR responses. [RT #20526]

2748. [func] Identify bad answers from GTLD servers and treat them as referrals. [RT #18884]

back out change 2740

2740. [func] Identify bad answers from GTLD servers and treat them as referrals. [RT #18884]