Hi @greg-bock! Thanks for the PR. Most of the code looks good, just two minor remarks.

1. I'd prefer you'd use dname_compare() instead of testing for pointer equality. While that'll work just fine for now, in the future there could be modifications that would invalidate the check.
2. The name additional-from-auth doesn't hold much value in NSD as it's an authoritative-only nameserver (bind had additional-from-cache too). Apart from that, as you stated, the option has been removed from bind in 9.12, which may cause some confusion. How about confine-to-zone: <yes|no>? That way the option can also just be initialized to 0.

I'll happily accept the changes once the issues have been resolved.

I'll make the changes shortly. Thanks for the feedback!

@k0ekk0ek let me know if you want me to squash this into a single commit and force push the branch to clean up history.

@greg-bock, sorry for the delay. I wanted to give the other committers a chance to react to the proposed changes. I'm assuming they're fine with the changes, so I'll go ahead and merge this. Squashing won't be necessary, GitHub allows me to squash the changes and combine them in a single commit. Thanks again!

Thanks!