Commit 6a9fa41ca5 for bind

commit 6a9fa41ca5db1e4f440b0afc3c3c16958fa0c891
Merge: b7166490fb 6c5f522546
Author: Ondřej Surý <ondrej@isc.org>
Date:   Mon Oct 5 09:53:58 2026 +0200

    fix: usr: Resolve names in insecure zones whose apex answers with a CNAME

    A validating resolver returned SERVFAIL for names in an unsigned zone whose apex answers with a CNAME, because the validator refused to look up the DS proof that shows the zone is
    insecure. That lookup is now allowed, and the cache keeps a CNAME next to other records at the same name (including the parent's delegation data) instead of deleting one for the other,
    choosing the fresher record at lookup time; this supersedes the earlier fix for stale answers after a record changes to or from a CNAME.

    Closes #6435

    Merge branch '6435-insecure-apex-cname-test' into 'main'

    See merge request isc-projects/bind9!12838