NXDOMAIN is incorrectly synthesized from NSEC for records under a DNAME
zone1: foo.zone1 IN DNAME zone2 foo.zone1 IN NSEC fzz.zone1. fzz.zone1 IN A 184.108.40.206 (...)
zone2: a IN A 220.127.116.11
if we force named to cache foo.zone1 (e.g. by dig ns foo.zone1) then all subsequent queries to names under foo.zone1 (e.g. dig a a.foo.zone1) will fail because named will incorrectly synthesize an NXDOMAIN from the NSEC record.