Thanks both Michael and Santiago for sorting this out! I agree that backporting https://github.com/NLnetLabs/ldns/commit/4d2057f0b5220487882be1b19c302833b84cffe3 to 1.7.1 is the most reasonable/conservative fix. We want that to propagate into testing as soon as possible without risking being blocked by any other surprising regressions.
I'll take care of that as part of the debian DNS team right now, which should take care of the NMU as well. --dkg
signature.asc
Description: PGP signature