Re: .dk-TLD-problems

Do you actually have to return an NXDOMAIN?  If so follow Paul's
advice, but I would think you need to return a root referral or a
REFUSED response.

For a root referral, you just need to add these records:

    &.:198.41.0.4:a.root-servers.net
    &.:192.228.79.201:b.root-servers.net
    &.:192.33.4.12:c.root-servers.net
    &.:128.8.10.90:d.root-servers.net
    &.:192.203.230.10:e.root-servers.net
    &.:192.5.5.241:f.root-servers.net
    &.:192.112.36.4:g.root-servers.net
    &.:128.63.2.53:h.root-servers.net
    &.:192.36.148.17:i.root-servers.net
    &.:192.58.128.30:j.root-servers.net
    &.:193.0.14.129:k.root-servers.net
    &.:199.7.83.42:l.root-servers.net
    &.:202.12.27.33:m.root-servers.net

You might be able to even get away with just (and if so, this is preferable):

    &.::a.root-servers.net

Alternatively, you can change tinydns's behavior to mimic BIND's and
return REFUSED responses for queries that it's non-authoritative for:

--- server.c.orig	2009-09-09 11:59:29.000000000 -0700
+++ server.c	2009-09-09 11:59:35.000000000 -0700
@@ -56,8 +56,10 @@

   case_lowerb(q,dns_domain_length(q));
   if (!respond(q,qtype,ip)) {
+    response[3] &= ~15;
+    response[3] |= 5;
     qlog(ip,port,header,q,qtype," - ");
-    return 0;
+    return 1;
   }
   qlog(ip,port,header,q,qtype," + ");
   return 1;