Francis pointed out in RT #34313 and #32406 that the code for setting the CD bit in resolver.c doesn't match the comment, or the intention. Currently it always sets CD=1 on queries to forwarders. By default, it should start with CD=0 and retry with CD=1 if it gets a SERVFAIL. We should probably add another fetch option to make it *always* use CD=1, and continue to use NOCDFLAG when we want it only to use CD=0 and then give up. Possibly these options should be configurable in a "server" statement.