jcoffey-dev
8a4f1febe5
The vendored hickory proves the delegation below google.com insecure itself, so validated_lookup no longer takes the recheck path for aspmx.l.google.com and the test's `validated.insecure` assertion failed. Assert what matters instead: the answer comes out insecure, by either path. Through Hetzner's resolver, hickory alone also accepts the signed-CNAME TLSA denial now; the recheck stays as a fallback.