Commit 331d9ea922 for bind

commit 331d9ea922dfdeee2399f17bf46c3d24a79f31c7
Author: Ondřej Surý <ondrej@isc.org>
Date:   Tue Nov 10 12:17:02 2026 +0100

    Do not prefetch RRSIG rdatasets

    An ANY response served from the cache offers every rdataset at the
    name for prefetching, the signatures included. Signatures cannot be
    fetched on their own any more, so such a prefetch failed right away
    but was still counted, and the rdataset lost its prefetch eligibility.
    Signatures are refreshed together with the RRset they cover.

    Assisted-by: Claude:claude-fable-5-2

diff --git a/lib/ns/query.c b/lib/ns/query.c
index c16d2bfe9f..b87dea132f 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -2683,10 +2683,15 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
 	       dns_rdataset_t *rdataset) {
 	CTRACE(ISC_LOG_DEBUG(3), "query_prefetch");

+	/*
+	 * Signatures are refreshed with the RRset they cover; they
+	 * cannot be fetched on their own.
+	 */
 	if (FETCH_RECTYPE_PREFETCH(client) != NULL ||
 	    client->inner.view->prefetch_trigger == 0U ||
 	    rdataset->ttl > client->inner.view->prefetch_trigger ||
-	    !rdataset->attributes.prefetch)
+	    !rdataset->attributes.prefetch ||
+	    dns_rdatatype_issig(rdataset->type))
 	{
 		/* maybe refresh stale data */
 		query_stale_refresh(client, qname, rdataset);