anchor.diff:      _ ->
         []
     end.
  +
  +maybe_sign_rrset(Message, Records, Zone) ->
  +  case {proplists:get_bool(dnssec, erldns_edns:get_opts(Message)), Zone#zone.keysets}  of
  +    {true, []} ->
  +      % DNSSEC requested, zone not signed
  +      Records;
  +    {true, _} ->
  +      % DNSSEC requested, zone signed
  +      Records ++ erldns_dnssec:rrsig_for_zone_rrset(Zone, Records);
  +    {false, _} ->
  +      % DNSSEC not requested
  +      Records
  +  end.
  
positive.code:   case TypeMatches of
      [] ->
        %% Ask the custom handlers for their records.
        NewRecords = lists:flatten(lists:map(custom_lookup(Qname, Qtype, MatchedRecords), erldns_handler:get_handlers())),
        resolve_exact_match(Message, Qname, Qtype, Host, CnameChain, MatchedRecords, Zone, NewRecords, AuthorityRecords);
      _ ->
        resolve_exact_match(Message, Qname, Qtype, Host, CnameChain, MatchedRecords, Zone, TypeMatches, AuthorityRecords)
  
negative.code:   case TypeMatches of
      [] ->
        %% Ask the custom handlers for their records.
        NewRecords = maybe_sign_rrset(Message, lists:map(erldns_records:replace_name(Qname), lists:flatten(lists:map(custom_lookup(Qname, Qtype, MatchedRecords), erldns_handler:get_handlers()))), Zone),
        resolve_best_match_with_wildcard(Message, Qname, Qtype, Host, CnameChain, MatchedRecords, Zone, [], NewRecords);
      _ ->
        resolve_best_match_with_wildcard(Message, Qname, Qtype, Host, CnameChain, MatchedRecords, Zone, [], TypeMatches)
  