Thank you for the report. This is a known bug; the restriction of
cross-zone CNAMEs was being incorrectly applied to recursive queries as
well as authoritative.  (The bug has existed for a long time, actually,
but was masked by another one that went away when we removed
additional-from-auth.)  Someone else reported the same issue last week,
and it's already been fixed for the 9.12.1 maintenance release.

If you wish you can pull an updated version of the v9_12 branch from our
source repository (source.isc.org), or apply the attached patch.