diff -u -r /root/bind9-setup/bind-9.8.0//bin/named/config.c /root/bind9-setup/bind-9.8.0-mod//bin/named/config.c
--- /root/bind9-setup/bind-9.8.0//bin/named/config.c	2011-02-03 00:50:05.000000000 -0500
+++ /root/bind9-setup/bind-9.8.0-mod//bin/named/config.c	2011-04-17 17:50:40.323805520 -0400
@@ -155,6 +155,7 @@
 	max-acache-size 16M;\n\
 	dnssec-enable yes;\n\
 	dnssec-validation yes; \n\
+	dnssec-always-validate no;\n\
 	dnssec-accept-expired no;\n\
 	clients-per-query 10;\n\
 	max-clients-per-query 100;\n\
diff -u -r /root/bind9-setup/bind-9.8.0//bin/named/named.conf.docbook /root/bind9-setup/bind-9.8.0-mod//bin/named/named.conf.docbook
--- /root/bind9-setup/bind-9.8.0//bin/named/named.conf.docbook	2011-02-03 00:50:05.000000000 -0500
+++ /root/bind9-setup/bind-9.8.0-mod//bin/named/named.conf.docbook	2011-04-17 17:55:24.575324089 -0400
@@ -285,6 +285,7 @@
 	disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>; ... };
 	dnssec-enable <replaceable>boolean</replaceable>;
 	dnssec-validation <replaceable>boolean</replaceable>;
+	dnssec-always-validate <replaceable>boolean</replaceable>;
 	dnssec-lookaside <replaceable>string</replaceable> trust-anchor <replaceable>string</replaceable>;
 	dnssec-lookaside ( <replaceable>auto</replaceable> | <replaceable>domain</replaceable> trust-anchor <replaceable>domain</replaceable> );
 	dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
@@ -473,6 +474,7 @@
 	disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>; ... };
 	dnssec-enable <replaceable>boolean</replaceable>;
 	dnssec-validation <replaceable>boolean</replaceable>;
+	dnssec-always-validate <replaceable>boolean</replaceable>;
 	dnssec-lookaside <replaceable>string</replaceable> trust-anchor <replaceable>string</replaceable>;
 	dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
 	dnssec-accept-expired <replaceable>boolean</replaceable>;
diff -u -r /root/bind9-setup/bind-9.8.0//bin/named/named.conf.html /root/bind9-setup/bind-9.8.0-mod//bin/named/named.conf.html
--- /root/bind9-setup/bind-9.8.0//bin/named/named.conf.html	2011-02-03 07:29:12.000000000 -0500
+++ /root/bind9-setup/bind-9.8.0-mod//bin/named/named.conf.html	2011-04-17 18:17:59.841462498 -0400
@@ -251,6 +251,7 @@
 	disable-algorithms <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>; ... };<br>
 	dnssec-enable <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-validation <em class="replaceable"><code>boolean</code></em>;<br>
+	dnssec-always-validate <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-lookaside <em class="replaceable"><code>string</code></em> trust-anchor <em class="replaceable"><code>string</code></em>;<br>
 	dnssec-lookaside ( <em class="replaceable"><code>auto</code></em> | <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em> );<br>
 	dnssec-must-be-secure <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>boolean</code></em>;<br>
@@ -438,6 +439,7 @@
 	disable-algorithms <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>; ... };<br>
 	dnssec-enable <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-validation <em class="replaceable"><code>boolean</code></em>;<br>
+	dnssec-always-validate <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-lookaside <em class="replaceable"><code>string</code></em> trust-anchor <em class="replaceable"><code>string</code></em>;<br>
 	dnssec-must-be-secure <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-accept-expired <em class="replaceable"><code>boolean</code></em>;<br>
diff -u -r /root/bind9-setup/bind-9.8.0//bin/named/query.c /root/bind9-setup/bind-9.8.0-mod//bin/named/query.c
--- /root/bind9-setup/bind-9.8.0//bin/named/query.c	2011-02-18 10:27:58.000000000 -0500
+++ /root/bind9-setup/bind-9.8.0-mod//bin/named/query.c	2011-04-17 18:43:24.223838725 -0400
@@ -6896,6 +6896,14 @@
 	client->next = query_next_callback;
 
 	/*
+	 * Clear the CD bit in the query if dnssec-always-validate is set and
+	 * DNSSEC is enabled with validation
+	 */
+	if(client->view->enablednssec && client->view->enablevalidation &&
+		client->view->alwaysvalidate)
+		message->flags &= ~DNS_MESSAGEFLAG_CD;
+
+	/*
 	 * Behave as if we don't support DNSSEC if not enabled.
 	 */
 	if (!client->view->enablednssec) {
diff -u -r /root/bind9-setup/bind-9.8.0//bin/named/server.c /root/bind9-setup/bind-9.8.0-mod//bin/named/server.c
--- /root/bind9-setup/bind-9.8.0//bin/named/server.c	2011-02-16 14:46:12.000000000 -0500
+++ /root/bind9-setup/bind-9.8.0-mod//bin/named/server.c	2011-04-17 18:41:15.517890905 -0400
@@ -2006,6 +2006,11 @@
 	}
 
 	obj = NULL;
+	result = ns_config_get(maps, "dnssec-always-validate", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	view->alwaysvalidate = cfg_obj_asboolean(obj);
+
+	obj = NULL;
 	result = ns_config_get(maps, "max-cache-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	view->maxcachettl = cfg_obj_asuint32(obj);
diff -u -r /root/bind9-setup/bind-9.8.0//doc/arm/Bv9ARM-book.xml /root/bind9-setup/bind-9.8.0-mod//doc/arm/Bv9ARM-book.xml
--- /root/bind9-setup/bind-9.8.0//doc/arm/Bv9ARM-book.xml	2011-02-03 02:39:02.000000000 -0500
+++ /root/bind9-setup/bind-9.8.0-mod//doc/arm/Bv9ARM-book.xml	2011-04-17 20:22:58.313882079 -0400
@@ -5018,6 +5018,7 @@
     <optional> ixfr-from-differences (<replaceable>yes_or_no</replaceable> | <constant>master</constant> | <constant>slave</constant>); </optional>
     <optional> dnssec-enable <replaceable>yes_or_no</replaceable>; </optional>
     <optional> dnssec-validation (<replaceable>yes_or_no</replaceable> | <constant>auto</constant>); </optional>
+    <optional> dnssec-always-validate <replaceable>yes_or_no</replaceable>; </optional>
     <optional> dnssec-lookaside ( <replaceable>auto</replaceable> | 
                         <replaceable>domain</replaceable> trust-anchor <replaceable>domain</replaceable> ); </optional>
     <optional> dnssec-must-be-secure <replaceable>domain yes_or_no</replaceable>; </optional>
@@ -6633,6 +6634,24 @@
                 </para>
               </listitem>
             </varlistentry>
+
+            <varlistentry>
+              <term><command>dnssec-always-validate</command></term>
+              <listitem>
+                <para>
+                  If set to <userinput>yes</userinput>, require DNSSEC validation in <command>named</command>
+                  for all queries. In other words clear the CD bit (Checking Disabled) in all queries before
+                  processing them. This is useful in the scenario where a Windows Server 2008 R2 DNS server is
+                  using a BIND server as a forwarder. The Windows DNS server normally forwards queries with the
+                  DO and CD bits set, even when it is incapable of doing DNSSEC validation on its own. This
+                  effectively disables DNSSEC validation for the clients of the Windows DNS server. With this option
+                  set to <userinput>yes</userinput>, the BIND server returns a proper SERVFAIL reponse code to the
+                  Windows DNS server when DNSSEC validation fails, rather than returning invalid answers. Setting
+                  <command>dnssec-always-validate</command> to <userinput>no</userinput>, the default, causes
+                  <command>named</command> to interpret the CD bit in queries according to standards.
+                </para>
+              </listitem>
+            </varlistentry>
 
             <varlistentry>
               <term><command>dnssec-accept-expired</command></term>
diff -u -r /root/bind9-setup/bind-9.8.0//doc/arm/Bv9ARM.ch06.html /root/bind9-setup/bind-9.8.0-mod//doc/arm/Bv9ARM.ch06.html
--- /root/bind9-setup/bind-9.8.0//doc/arm/Bv9ARM.ch06.html	2011-02-03 07:29:13.000000000 -0500
+++ /root/bind9-setup/bind-9.8.0-mod//doc/arm/Bv9ARM.ch06.html	2011-04-17 20:23:21.664778532 -0400
@@ -3438,6 +3438,22 @@
                   <span><strong class="command">managed-keys</strong></span> statement.  The default
                   is <strong class="userinput"><code>yes</code></strong>.
                 </p></dd>
+<dt><span class="term"><span><strong class="command">dnssec-always-validate</strong></span></span></dt>
+<dd><p>
+                  If set to <strong class="userinput"><code>yes</code></strong>, require DNSSEC validation in
+                  <span><strong class="command">named</strong></span> for all queries. In other words clear the
+                  CD bit (Checking Disabled) in all queries before processing them. This is useful in the
+                  scenario where a Windows Server 2008 R2 DNS server is using a BIND server as a forwarder. The
+                  Windows DNS server normally forwards queries with the DO and CD bits set, even when it is
+                  incapable of doing DNSSEC validation on its own. This effectively disables DNSSEC validation
+                  for the clients of the Windows DNS server. With this option set to
+                  <strong class="userinput"><code>yes</code></strong>, the BIND server returns a proper SERVFAIL
+                  reponse code to the Windows DNS server when DNSSEC validation fails, rather than returning
+                  invalid answers. Setting <span><strong class="command">dnssec-always-validate</strong></span> to
+                  <strong class="userinput"><code>no</code></strong>, the default, causes
+                  <span><strong class="command">named</strong></span> to interpret the CD bit in queries according
+                  to standards.
+                </p></dd>
 <dt><span class="term"><span><strong class="command">dnssec-accept-expired</strong></span></span></dt>
 <dd><p>
                   Accept expired signatures when verifying DNSSEC signatures.
diff -u -r /root/bind9-setup/bind-9.8.0//doc/misc/options /root/bind9-setup/bind-9.8.0-mod//doc/misc/options
--- /root/bind9-setup/bind-9.8.0//doc/misc/options	2011-02-03 07:29:19.000000000 -0500
+++ /root/bind9-setup/bind-9.8.0-mod//doc/misc/options	2011-04-17 20:28:31.106531693 -0400
@@ -117,6 +117,7 @@
         dnssec-must-be-secure <string> <boolean>;
         dnssec-secure-to-insecure <boolean>;
         dnssec-validation ( yes | no | auto );
+        dnssec-always-validate <boolean>;
         dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
             <integer> ] | <ipv4_address> [ port <integer> ] |
             <ipv6_address> [ port <integer> ] ); ... };
@@ -336,6 +337,7 @@
         dnssec-must-be-secure <string> <boolean>;
         dnssec-secure-to-insecure <boolean>;
         dnssec-validation ( yes | no | auto );
+        dnssec-always-validate <boolean>;
         dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
             <integer> ] | <ipv4_address> [ port <integer> ] |
             <ipv6_address> [ port <integer> ] ); ... };
diff -u -r /root/bind9-setup/bind-9.8.0//lib/bind9/check.c /root/bind9-setup/bind-9.8.0-mod//lib/bind9/check.c
--- /root/bind9-setup/bind-9.8.0//lib/bind9/check.c	2011-01-07 18:47:07.000000000 -0500
+++ /root/bind9-setup/bind-9.8.0-mod//lib/bind9/check.c	2011-04-17 20:41:17.830334343 -0400
@@ -2077,7 +2077,7 @@
 	isc_result_t tresult = ISC_R_SUCCESS;
 	cfg_aclconfctx_t actx;
 	const cfg_obj_t *obj;
-	isc_boolean_t enablednssec, enablevalidation;
+	isc_boolean_t enablednssec, enablevalidation, alwaysvalidate;
 
 	/*
 	 * Check that all zone statements are syntactically correct and
@@ -2186,7 +2186,7 @@
 	isc_symtab_destroy(&symtab);
 
 	/*
-	 * Check that dnssec-enable/dnssec-validation are sensible.
+	 * Check that dnssec-enable/dnssec-validation/dnssec-always-validate are sensible.
 	 */
 	obj = NULL;
 	if (voptions != NULL)
@@ -2208,10 +2208,28 @@
 	else
 		enablevalidation = cfg_obj_asboolean(obj);
 
+	obj = NULL;
+	if (voptions != NULL)
+		(void)cfg_map_get(voptions, "dnssec-always-validate", &obj);
+	if (obj == NULL)
+		(void)cfg_map_get(config, "dnssec-always-validate", &obj);
+	if (obj == NULL)
+		enablednssec = ISC_FALSE;
+	else
+		enablednssec = cfg_obj_asboolean(obj);
+
 	if (enablevalidation && !enablednssec)
 		cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
 			    "'dnssec-validation yes;' and 'dnssec-enable no;'");
 
+	if (alwaysvalidate && !enablednssec)
+		cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
+			    "'dnssec-always-validate yes;' and 'dnssec-enable no;'");
+
+	if (alwaysvalidate && !enablevalidation)
+		cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
+			    "'dnssec-always-validate yes;' and 'dnssec-validation no;'");
+
 	/*
 	 * Check trusted-keys and managed-keys.
 	 */
diff -u -r /root/bind9-setup/bind-9.8.0//lib/dns/include/dns/view.h /root/bind9-setup/bind-9.8.0-mod//lib/dns/include/dns/view.h
--- /root/bind9-setup/bind-9.8.0//lib/dns/include/dns/view.h	2011-01-12 20:59:28.000000000 -0500
+++ /root/bind9-setup/bind-9.8.0-mod//lib/dns/include/dns/view.h	2011-04-17 20:47:17.226844222 -0400
@@ -124,6 +124,7 @@
 	isc_boolean_t			minimalresponses;
 	isc_boolean_t			enablednssec;
 	isc_boolean_t			enablevalidation;
+	isc_boolean_t			alwaysvalidate;
 	isc_boolean_t			acceptexpired;
 	dns_transfer_format_t		transfer_format;
 	dns_acl_t *			cacheacl;
diff -u -r /root/bind9-setup/bind-9.8.0//lib/dns/view.c /root/bind9-setup/bind-9.8.0-mod//lib/dns/view.c
--- /root/bind9-setup/bind-9.8.0//lib/dns/view.c	2011-01-13 04:53:04.000000000 -0500
+++ /root/bind9-setup/bind-9.8.0-mod//lib/dns/view.c	2011-04-17 20:44:52.430294391 -0400
@@ -163,6 +163,7 @@
 	view->additionalfromauth = ISC_TRUE;
 	view->enablednssec = ISC_TRUE;
 	view->enablevalidation = ISC_TRUE;
+	view->alwaysvalidate = ISC_FALSE;
 	view->acceptexpired = ISC_FALSE;
 	view->minimalresponses = ISC_FALSE;
 	view->transfer_format = dns_one_answer;
diff -u -r /root/bind9-setup/bind-9.8.0//lib/isccfg/namedconf.c /root/bind9-setup/bind-9.8.0-mod//lib/isccfg/namedconf.c
--- /root/bind9-setup/bind-9.8.0//lib/isccfg/namedconf.c	2011-02-03 00:50:08.000000000 -0500
+++ /root/bind9-setup/bind-9.8.0-mod//lib/isccfg/namedconf.c	2011-04-17 20:51:07.026982948 -0400
@@ -1212,6 +1212,7 @@
 	{ "dnssec-must-be-secure",  &cfg_type_mustbesecure,
 	  CFG_CLAUSEFLAG_MULTI },
 	{ "dnssec-validation", &cfg_type_boolorauto, 0 },
+	{ "dnssec-always-validate", &cfg_type_boolean, 0 },
 	{ "dual-stack-servers", &cfg_type_nameportiplist, 0 },
 	{ "edns-udp-size", &cfg_type_uint32, 0 },
 	{ "empty-contact", &cfg_type_astring, 0 },
