content-type: text/plain; charset="utf-8"
Content-Disposition: inline
X-RT-Original-Encoding: utf-8
Content-Length: 546

Thank you for the report. This is a known bug; the restriction of
cross-zone CNAMEs was being incorrectly applied to recursive queries as
well as authoritative.  (The bug has existed for a long time, actually,
but was masked by another one that went away when we removed
additional-from-auth.)  Someone else reported the same issue last week,
and it's already been fixed for the 9.12.1 maintenance release.

If you wish you can pull an updated version of the v9_12 branch from our
source repository (source.isc.org), or apply the attached patch.