NXDOMAIN is incorrectly synthesized from NSEC for records under a DNAME
zone1: foo.zone1 IN DNAME zone2 foo.zone1 IN NSEC fzz.zone1. fzz.zone1 IN A 18.104.22.168 (...)
zone2: a IN A 22.214.171.124
if we force named to cache foo.zone1 (e.g. by dig ns foo.zone1) then all subsequent queries to names under foo.zone1 (e.g. dig a a.foo.zone1) will fail because named will incorrectly synthesize an NXDOMAIN from the NSEC record.