g0tar

I had to use `c->key` instead of `key` in 2nd chunk, but now it looks really good:) I got test loop running for 10 minutes and everything is being handled...

I'm pushing the limits and all broken connections are reconnected. One question though - assuming all connections are being broken and reconnected, is this the expected loop (under extremely short...

> What we have been pondering lately is to add an option to skip a cache-hit 1 out of `T` times when the remaining validity of an entry is lower...

I've just had and verified an idea, that the in-cache duration is shortened by `maxTTL` packet cache setting, i.e. this reduces the entry lifespan, but doesn't reduce returned TTL value...

Sure: [recursor-16540.trace.log](https://github.com/user-attachments/files/23712905/recursor-16540.trace.log)

I think that being authoritative for signatures shouldn't matter - after all, they are about to (should) be validated. I.e. routing the queries is distinct from validating the chain of...

I was afraid of that (or some poisoning). I wouldn't dare to suggest adding some special flag for such rare case... But this is relevant only on defined zones boundaries...

It's not signed - it still doesn't exist and the proof comes from `.`. All I want is to route-away such queries to different resolver. In reality I got dozen...

Although it looks synthetic, I do forward these 8 non-existing (reserved) zones on purpose ([rationale above](https://github.com/PowerDNS/pdns/issues/16540#issuecomment-3570394634)). The actual config forwards them to secondary "straight" `recursor` and `.` to `dnsdist`, but...

ING BSK (polish division of ING Groep N.V., 4th in size, mandatory), Alior Bank (8th biggest bank in Poland, government-owned, masked are optional now), Pekao SA (the 2nd biggest polish...