consider this zone:
example.org. SOA (...)
a.example.org. CNAME b
b.example.org. CNAME c
c.example.org. A 1.2.3.4
a query for "a.example.org. A" with DNSSEC and CNAME flattening enabled returns the following result:
;; ANSWER SECTION:
a.example.org. CNAME b.example.org.
a.example.org. RRSIG (...)
b.example.org. CNAME c.example.org.
b.example.org. RRSIG (...)
c.example.org. A 1.2.3.4
c.example.org. RRSIG (...)
;; AUTHORITY SECTION:
;; empty
shouldn't there be an NSEC record for each CNAME to prove there's no A record?
e.g:
;; AUTHORITY SECTION:
a.example.org. NSEC b.example.org. CNAME RRSIG NSEC
a.example.org. RRSIG (...)
b.example.org. NSEC c.example.org. CNAME RRSIG NSEC
b.example.org. RRSIG (...)