Description of problem:  If you have a DNS record which is a CNAME pointing to a DNAME record, DNS resolution attempts through Redhat bind result in a servfail instead of returning the record when the cache expires.  


Version-Release number of selected component (if applicable):  I think we have isolated this to bind93-CVE-2016-8864.patch being applied.  bind-9.3.6-25.P1.el5_11.11


How reproducible: 100% reproducible. 


Steps to Reproduce:
1.  Install and setup bind to be a caching forwarder to any DNS service (googles DNS at 8.8.8.8 is reliable) using forward only.   
2.  On a separate DNS service, create a record (uses 2 zones) which looks like this (set the TTL to 0 to reproduce every time.  You will get intermittent responses if you have a cacheable TTL):
abc4.test.stevenngo.me.		IN	CNAME	roy.osd.test.stevenngo.me.
osd.test.stevenngo.me.		IN	DNAME	test2.stevenngo.me.
roy.test2.stevenngo.me.		IN	A	12.12.12.12

3. send a dig through your recursive resolver in an attempt to resolve the request.

Actual results:
[root@ip-172-31-53-34 etc]# dig @localhost abc4.test.stevenngo.me.

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-25.P1.el5_11.11 <<>> @localhost abc4.test.stevenngo.me.
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 61216
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;abc4.test.stevenngo.me.		IN	A

;; Query time: 53 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Nov 29 10:47:51 2016
;; MSG SIZE  rcvd: 40

[root@ip-172-31-53-34 etc]#


Expected results:
[root@ip-172-31-53-34 etc]# dig @8.8.8.8 abc4.test.stevenngo.me.

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-25.P1.el5_11.11 <<>> @8.8.8.8 abc4.test.stevenngo.me.
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5920
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;abc4.test.stevenngo.me.		IN	A

;; ANSWER SECTION:
abc4.test.stevenngo.me.	0	IN	CNAME	roy.osd.test.stevenngo.me.
osd.test.stevenngo.me.	0	IN	DNAME	test2.stevenngo.me.
roy.osd.test.stevenngo.me. 0	IN	CNAME	roy.test2.stevenngo.me.
roy.test2.stevenngo.me.	0	IN	A	12.12.12.12

;; Query time: 27 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Nov 29 10:48:53 2016
;; MSG SIZE  rcvd: 134

[root@ip-172-31-53-34 etc]#


Additional info:
[root@ip-172-31-53-34 etc]# rpm -qa | grep bind
bind-chroot-9.3.6-25.P1.el5_11.11
bind-libs-9.3.6-25.P1.el5_11.11
bind-9.3.6-25.P1.el5_11.11
bind-utils-9.3.6-25.P1.el5_11.11
[root@ip-172-31-53-34 etc]#
[root@ip-172-31-53-34 etc]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.11 (Tikanga)
[root@ip-172-31-53-34 etc]#
[root@ip-172-31-53-34 etc]# cat named.conf
options {
  directory "/var/named";
  version "get lost";
  recursion yes;
  allow-transfer {"none";};
  allow-recursion {127.0.0.1/32;};
  forwarders {
                8.8.8.8;
                8.8.4.4;
  };
  forward only;
};
include "/etc/named.root.hints";
[root@ip-172-31-53-34 etc]#