Always return a SERVFAIL response to DNS queries with RD=0.

Unless we are acting in authoritative mode, obviously.

To do otherwise may allows cache snooping, see.
http://cs.unc.edu/~fabian/course_papers/cache_snooping.pdf

CHANGELOG

@@ -6,6 +6,10 @@ version 2.79
 	upstream servers to an interface, rather than SO_BINDTODEVICE.
 	Thanks to Beniamino Galvani for the patch.
 
+	Always return a SERVFAIL answer to DNS queries without the
+	recusion desired bit set, UNLESS acting as a authoritative
+	DNS server. This avoids a potential route to cache snooping.
+
 
 version 2.78
         Fix logic of appending ".<layer>" to PXE basename. Thanks to Chris