From ee5e86a45d2dbdca600b913d9e1bf4a2be7f1f29 Mon Sep 17 00:00:00 2001
From: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
Date: Mon, 9 Dec 2024 10:30:01 +0100
Subject: [PATCH] Strip ZONEMD RRs on load so that signing without ZONEMD
 doesn't leave an incorrect ZONEMD RR in the output.

---
 src/commands/signzone.rs | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/commands/signzone.rs b/src/commands/signzone.rs
index 7615802..d76ee2f 100644
--- a/src/commands/signzone.rs
+++ b/src/commands/signzone.rs
@@ -1004,9 +1004,16 @@ impl SignZone {
                     // once, while our current implementation only supports
                     // having either NSEC or NSEC3 in the zone at any one
                     // time.
+                    //
+                    // TODO: NSEC3PARAM and ZONEMD should only be ignored at
+                    // the apex (the only place RFCs define them to be valid).
                     if !matches!(
                         record.rtype(),
-                        Rtype::NSEC | Rtype::NSEC3 | Rtype::NSEC3PARAM | Rtype::RRSIG
+                        Rtype::NSEC
+                            | Rtype::NSEC3
+                            | Rtype::NSEC3PARAM
+                            | Rtype::RRSIG
+                            | Rtype::ZONEMD
                     ) {
                         let _ = records.insert(record);
                     }