Commit a29f573659 for bind

commit a29f57365952a1f3445ced723e26a4ea26a53c87
Author: Ondřej Surý <ondrej@isc.org>
Date:   Wed Nov 11 09:50:56 2026 +0100

    Remove the KEY exemption from CNAME matching again

    The special handling of KEY was dropped in b9c1b90b500, but the
    authoritative DELEG rework (099d6d7ee7c) brought the exemption from
    CNAME matching back into qpzone_find().  As the validator no longer
    accepts an NSEC with the CNAME bit set as proof that a KEY RRset
    does not exist, a KEY query for a CNAME owner in a signed zone was
    answered with a NODATA response that a validating BIND resolver
    turned into SERVFAIL.

diff --git a/lib/dns/qpzone.c b/lib/dns/qpzone.c
index b0d6b32f7b..5c7f816db4 100644
--- a/lib/dns/qpzone.c
+++ b/lib/dns/qpzone.c
@@ -1836,8 +1836,7 @@ cname_and_other(qpznode_t *node, uint32_t serial) {

 	/*
 	 * Look for CNAME and "other data" rdatasets active in our version.
-	 * ("Other data" is any rdataset whose type is not KEY, NSEC, SIG
-	 * or RRSIG.
+	 * ("Other data" is any rdataset whose type is not NSEC or RRSIG.
 	 */
 	ISC_SLIST_FOREACH(top, node->next_type, next_type) {
 		dns_rdatatype_t rdtype = DNS_TYPEPAIR_TYPE(top->typepair);
@@ -3715,12 +3714,10 @@ qpzone_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 	/*
 	 * If we're beneath a zone cut, we don't want to look for
 	 * CNAMEs because they're not legitimate zone glue. And
-	 * some DNSSEC types (KEY and NSEC) are not subject to CNAME
+	 * some DNSSEC types (NSEC) are not subject to CNAME
 	 * matching (see RFC4035, section 2.5, and RFC3007).
 	 */
-	if (search.zonecut != NULL || type == dns_rdatatype_key ||
-	    type == dns_rdatatype_nsec)
-	{
+	if (search.zonecut != NULL || type == dns_rdatatype_nsec) {
 		cname_ok = false;
 	}