DNS: return explicit error code to caller on dnssec failure, for better logging

[exim.git] / src / src / routers / dnslookup.c

diff --git a/src/src/routers/dnslookup.c b/src/src/routers/dnslookup.c
index d2be40e0fbffd47978730c4a3793366b0311976d..e4f7a2539335764ed1df37ebe0c75830ca07c657 100644 (file)
--- a/src/src/routers/dnslookup.c
+++ b/src/src/routers/dnslookup.c
@@ -291,6 +291,11 @@ for (;;)
   /* Deferral returns forthwith, and anything other than failure breaks the
   loop. */
 
+  if (rc == HOST_FIND_SECURITY)
+    {
+    addr->message = US"host lookup done insecurely";
+    return DEFER;
+    }
   if (rc == HOST_FIND_AGAIN)
     {
     if (rblock->pass_on_timeout)