Force clear the AD bit unless the DO bit was also set

dnscrypt-proxy/dnsutils.go

@@ -17,6 +17,7 @@ func EmptyResponseFromMessage(srcMsg *dns.Msg) *dns.Msg {
 	}
 	dstMsg.RecursionDesired = false
 	dstMsg.CheckingDisabled = false
+	dstMsg.AuthenticatedData = false
 	dstMsg.Answer = make([]dns.RR, 0)
 	dstMsg.Ns = make([]dns.RR, 0)
 	dstMsg.Extra = make([]dns.RR, 0)

dnscrypt-proxy/plugin_forward.go

@@ -97,6 +97,9 @@ func (plugin *PluginForward) Eval(pluginsState *PluginsState, msg *dns.Msg) erro
 	if err != nil {
 		return err
 	}
+	if edns0 := respMsg.IsEdns0(); edns0 == nil || !edns0.Do() {
+		respMsg.AuthenticatedData = false
+	}
 	pluginsState.synthResponse = respMsg
 	pluginsState.action = PluginsActionSynth
 	return nil