signature of the DNAME. [RT #915] A query should not match a DNAME whose trust level is pending. [RT #916]