Index: trunk/pdns/pdns/packethandler.cc
===================================================================
--- trunk/pdns/pdns/packethandler.cc	(revision 2183)
+++ trunk/pdns/pdns/packethandler.cc	(revision 2190)
@@ -1105,5 +1105,5 @@
     }
   }
-  if(p->d_dnssecOk) {
+  if(p->d_dnssecOk && d_dk.isSecuredZone(sd.qname)) {
     addNSECX(p, r, p->qdomain, sd.qname, 3);
   }