Index: daemon/worker.c
===================================================================
--- daemon/worker.c	(revision 4191)
+++ daemon/worker.c	(working copy)
@@ -663,8 +663,21 @@
 		if(!inplace_cb_reply_servfail_call(&worker->env, qinfo, NULL, rep,
 			LDNS_RCODE_SERVFAIL, edns, worker->scratchpad))
 			goto bail_out;
-		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
-			qinfo, id, flags, edns);
+		if (qinfo->qtype == LDNS_RR_TYPE_A &&
+			worker->env.cfg->redirect_bogus_ipv4) {
+			/* BAD cached */
+			fixed_address_encode(repinfo->c->buffer,
+				LDNS_RCODE_NOERROR, qinfo, id, flags, edns,
+				worker->env.cfg->redirect_bogus_ipv4);
+		} else if (qinfo->qtype == LDNS_RR_TYPE_AAAA &&
+			worker->env.cfg->redirect_bogus_ipv6) {
+			fixed_address_encode(repinfo->c->buffer,
+				LDNS_RCODE_NOERROR, qinfo, id, flags, edns,
+				worker->env.cfg->redirect_bogus_ipv6);
+		} else {
+			error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
+ 			qinfo, id, flags, edns);
+		}
 		rrset_array_unlock_touch(worker->env.rrset_cache, 
 			worker->scratchpad, rep->ref, rep->rrset_count);
 		if(worker->stats.extended) {
Index: doc/unbound.conf.5.in
===================================================================
--- doc/unbound.conf.5.in	(revision 4191)
+++ doc/unbound.conf.5.in	(working copy)
@@ -1244,6 +1244,18 @@
 This can make ordinary queries complete (if repeatedly queried for),
 and enter the cache, whilst also mitigating the traffic flow by the
 factor given.
+.TP 5
+.B redirect-bogus-ipv4: \fI<IPv4 address>
+Set a fixed address for DNSSEC failures that are cached
+Instead of responding to A queries with SERVFAIL, respond
+with NOERROR and the address specified here
+The TTL of the response will be 5 seconds
+.TP 5
+.B redirect-bogus-ipv6: \fI<IPv4 address>
+Set a fixed address for DNSSEC failures that are cached
+Instead of responding to AAAA queries with SERVFAIL, respond
+with NOERROR and the address specified here
+The TTL of the response will be 5 seconds
 .SS "Remote Control Options"
 In the
 .B remote\-control:
Index: services/mesh.c
===================================================================
--- services/mesh.c	(revision 4191)
+++ services/mesh.c	(working copy)
@@ -1006,6 +1006,7 @@
 	struct timeval end_time;
 	struct timeval duration;
 	int secure;
+	int bogus_override = 0;
 	/* Copy the client's EDNS for later restore, to make sure the edns
 	 * compare is with the correct edns options. */
 	struct edns_data edns_bak = r->edns;
@@ -1016,6 +1017,7 @@
 		rcode = LDNS_RCODE_SERVFAIL;
 		if(m->s.env->cfg->stat_extended) 
 			m->s.env->mesh->ans_bogus++;
+		bogus_override = 1;
 	}
 	if(rep && rep->security == sec_status_secure)
 		secure = 1;
@@ -1047,17 +1049,34 @@
 	} else if(rcode) {
 		m->s.qinfo.qname = r->qname;
 		m->s.qinfo.local_alias = r->local_alias;
-		if(rcode == LDNS_RCODE_SERVFAIL) {
-			if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
-				rep, rcode, &r->edns, m->s.region))
-					r->edns.opt_list = NULL;
-		} else { 
-			if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode,
-				&r->edns, m->s.region))
-					r->edns.opt_list = NULL;
+		if(bogus_override && m->s.qinfo.qtype == LDNS_RR_TYPE_A &&
+			m->s.env->cfg->redirect_bogus_ipv4) {
+			fixed_address_encode(r->query_reply.c->buffer,
+				LDNS_RCODE_NOERROR, &m->s.qinfo, r->qid,
+				r->qflags, &r->edns,
+				m->s.env->cfg->redirect_bogus_ipv4);
+		} else if(bogus_override &&
+			m->s.qinfo.qtype == LDNS_RR_TYPE_AAAA &&
+			m->s.env->cfg->redirect_bogus_ipv6) {
+			fixed_address_encode(r->query_reply.c->buffer,
+				LDNS_RCODE_NOERROR, &m->s.qinfo, r->qid,
+				r->qflags, &r->edns,
+				m->s.env->cfg->redirect_bogus_ipv6);
+		} else {
+			if(rcode == LDNS_RCODE_SERVFAIL) {
+				if(!inplace_cb_reply_servfail_call(m->s.env,
+					&m->s.qinfo, &m->s,
+					rep, rcode, &r->edns, m->s.region))
+						r->edns.opt_list = NULL;
+			} else { 
+				if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo,
+					&m->s, rep, rcode, &r->edns,
+					m->s.region))
+						r->edns.opt_list = NULL;
+			}
+			error_encode(r->query_reply.c->buffer, rcode,
+				&m->s.qinfo, r->qid, r->qflags, &r->edns);
 		}
-		error_encode(r->query_reply.c->buffer, rcode, &m->s.qinfo,
-			r->qid, r->qflags, &r->edns);
 		comm_point_send_reply(&r->query_reply);
 	} else {
 		size_t udp_size = r->edns.udp_size;
Index: util/config_file.c
===================================================================
--- util/config_file.c	(revision 4191)
+++ util/config_file.c	(working copy)
@@ -273,6 +273,8 @@
 	cfg->ratelimit_factor = 10;
 	cfg->qname_minimisation = 0;
 	cfg->qname_minimisation_strict = 0;
+	cfg->redirect_bogus_ipv4 = NULL;
+	cfg->redirect_bogus_ipv6 = NULL;
 	cfg->shm_enable = 0;
 	cfg->shm_key = 11777;
 	cfg->dnscrypt = 0;
@@ -602,6 +604,10 @@
 		}
 		oi[cfg->num_out_ifs++] = d;
 		cfg->out_ifs = oi;
+	} else if (strcmp(opt, "redirect-bogus-ipv4:") == 0) {
+		cfg->redirect_bogus_ipv4 = strdup(val);
+	} else if (strcmp(opt, "redirect-bogus-ipv6:") == 0) {
+		cfg->redirect_bogus_ipv6 = strdup(val);
 	} else {
 		/* unknown or unsupported (from the set_option interface):
 		 * interface, outgoing-interface, access-control,
@@ -1250,6 +1256,12 @@
 	free(cfg->dnstap_version);
 	config_deldblstrlist(cfg->ratelimit_for_domain);
 	config_deldblstrlist(cfg->ratelimit_below_domain);
+	if (cfg->redirect_bogus_ipv4) {
+		free(cfg->redirect_bogus_ipv4);
+	}
+	if (cfg->redirect_bogus_ipv6) {
+		free(cfg->redirect_bogus_ipv6);
+	}
 #ifdef USE_IPSECMOD
 	free(cfg->ipsecmod_hook);
 	config_delstrlist(cfg->ipsecmod_whitelist);
Index: util/config_file.h
===================================================================
--- util/config_file.h	(revision 4191)
+++ util/config_file.h	(working copy)
@@ -444,6 +444,9 @@
 	/** minimise QNAME in strict mode, minimise according to RFC.
 	 *  Do not apply fallback */
 	int qname_minimisation_strict;
+	/** construct fake responses for DNSSEC failures */
+	char *redirect_bogus_ipv4;
+	char *redirect_bogus_ipv6;
 	/** SHM data - true if shm is enabled */
 	int shm_enable;
 	/** SHM data - key for the shm */
Index: util/configlexer.lex
===================================================================
--- util/configlexer.lex	(revision 4191)
+++ util/configlexer.lex	(working copy)
@@ -410,6 +410,8 @@
 response-ip-tag{COLON}		{ YDVAR(2, VAR_RESPONSE_IP_TAG) }
 response-ip{COLON}		{ YDVAR(2, VAR_RESPONSE_IP) }
 response-ip-data{COLON}		{ YDVAR(2, VAR_RESPONSE_IP_DATA) }
+redirect-bogus-ipv4{COLON}	{ YDVAR(1, VAR_REDIRECT_BOGUS_IPV4) }
+redirect-bogus-ipv6{COLON}	{ YDVAR(1, VAR_REDIRECT_BOGUS_IPV6) }
 dnscrypt{COLON}			{ YDVAR(0, VAR_DNSCRYPT) }
 dnscrypt-enable{COLON}		{ YDVAR(1, VAR_DNSCRYPT_ENABLE) }
 dnscrypt-port{COLON}		{ YDVAR(1, VAR_DNSCRYPT_PORT) }
Index: util/configparser.y
===================================================================
--- util/configparser.y	(revision 4191)
+++ util/configparser.y	(working copy)
@@ -44,6 +44,7 @@
 #include <stdlib.h>
 #include <assert.h>
 
+#include "sldns/str2wire.h"
 #include "util/configyyrename.h"
 #include "util/config_file.h"
 #include "util/net_help.h"
@@ -141,6 +142,7 @@
 %token VAR_ACCESS_CONTROL_TAG_DATA VAR_VIEW VAR_ACCESS_CONTROL_VIEW
 %token VAR_VIEW_FIRST VAR_SERVE_EXPIRED VAR_FAKE_DSA VAR_FAKE_SHA1
 %token VAR_LOG_IDENTITY VAR_HIDE_TRUSTANCHOR VAR_TRUST_ANCHOR_SIGNALING
+%token VAR_REDIRECT_BOGUS_IPV4 VAR_REDIRECT_BOGUS_IPV6
 %token VAR_USE_SYSTEMD VAR_SHM_ENABLE VAR_SHM_KEY
 %token VAR_DNSCRYPT VAR_DNSCRYPT_ENABLE VAR_DNSCRYPT_PORT VAR_DNSCRYPT_PROVIDER
 %token VAR_DNSCRYPT_SECRET_KEY VAR_DNSCRYPT_PROVIDER_CERT
@@ -228,6 +230,7 @@
 	server_access_control_tag_data | server_access_control_view |
 	server_qname_minimisation_strict | server_serve_expired |
 	server_fake_dsa | server_log_identity | server_use_systemd |
+	server_redirect_bogus_ipv4 | server_redirect_bogus_ipv6 |
 	server_response_ip_tag | server_response_ip | server_response_ip_data |
 	server_shm_enable | server_shm_key | server_fake_sha1 |
 	server_hide_trustanchor | server_trust_anchor_signaling |
@@ -1873,6 +1876,34 @@
 	#endif
 	}
 	;
+server_redirect_bogus_ipv4: VAR_REDIRECT_BOGUS_IPV4 STRING_ARG
+	{
+		uint8_t data[4];
+		size_t data_len = 4;
+		OUTYY(("P(name:%s)\n", $2));
+		if(cfg_parser->cfg->redirect_bogus_ipv4) {
+			yyerror("redirect-bogus-ipv4, can only use one address");
+		}
+		if(sldns_str2wire_a_buf($2, data, &data_len) != LDNS_WIREPARSE_ERR_OK) {
+			yyerror("redirect-bogus-ipv4, not a valid IPv4 address");
+		}
+		free(cfg_parser->cfg->redirect_bogus_ipv4);
+		cfg_parser->cfg->redirect_bogus_ipv4 = $2;
+	}
+server_redirect_bogus_ipv6: VAR_REDIRECT_BOGUS_IPV6 STRING_ARG
+	{
+		uint8_t data[16];
+		size_t data_len = 16;
+		OUTYY(("P(name:%s)\n", $2));
+		if(cfg_parser->cfg->redirect_bogus_ipv6) {
+			yyerror("redirect-bogus-ipv6, can only use one address");
+		}
+		if(sldns_str2wire_aaaa_buf($2, data, &data_len) != LDNS_WIREPARSE_ERR_OK) {
+			yyerror("redirect-bogus-ipv6, not a valid IPv6 address");
+		}
+		free(cfg_parser->cfg->redirect_bogus_ipv6);
+		cfg_parser->cfg->redirect_bogus_ipv6 = $2;
+	}
 stub_name: VAR_NAME STRING_ARG
 	{
 		OUTYY(("P(name:%s)\n", $2));
Index: util/data/msgencode.c
===================================================================
--- util/data/msgencode.c	(revision 4191)
+++ util/data/msgencode.c	(working copy)
@@ -48,6 +48,7 @@
 #include "util/regional.h"
 #include "util/net_help.h"
 #include "sldns/sbuffer.h"
+#include "sldns/str2wire.h"
 #include "services/localzone.h"
 
 /** return code that means the function ran out of memory. negative so it does
@@ -914,3 +915,63 @@
 		attach_edns_record(buf, &es);
 	}
 }
+
+void 
+fixed_address_encode(sldns_buffer* buf, int r, struct query_info* qinfo,
+	uint16_t qid, uint16_t qflags, struct edns_data* edns, char* data)
+{
+	uint16_t flags;
+	uint8_t addr_data[16];
+	size_t addr_len = 16;
+	if (qinfo->qtype == LDNS_RR_TYPE_A) {
+		sldns_str2wire_a_buf(data, addr_data, &addr_len);
+	} else if (qinfo->qtype == LDNS_RR_TYPE_AAAA) {
+		sldns_str2wire_aaaa_buf(data, addr_data, &addr_len);
+	} else {
+		return error_encode(buf, LDNS_RCODE_NOERROR, qinfo, qid, qflags, edns);
+	}
+	sldns_buffer_clear(buf);
+	sldns_buffer_write(buf, &qid, sizeof(uint16_t));
+	flags = (uint16_t)(BIT_QR | BIT_RA | r); /* QR and retcode*/
+	flags |= (qflags & (BIT_RD|BIT_CD)); /* copy RD and CD bit */
+	sldns_buffer_write_u16(buf, flags);
+	if(qinfo) flags = 1;
+	else	flags = 0;
+	sldns_buffer_write_u16(buf, flags);
+	sldns_buffer_write_u16(buf, 1);
+	flags = 0;
+	sldns_buffer_write(buf, &flags, sizeof(uint16_t));
+	sldns_buffer_write(buf, &flags, sizeof(uint16_t));
+	if(qinfo) {
+		// query
+		if(sldns_buffer_current(buf) == qinfo->qname)
+			sldns_buffer_skip(buf, (ssize_t)qinfo->qname_len);
+		else	sldns_buffer_write(buf, qinfo->qname, qinfo->qname_len);
+		sldns_buffer_write_u16(buf, qinfo->qtype);
+		sldns_buffer_write_u16(buf, qinfo->qclass);
+		// faked answer
+		if(sldns_buffer_current(buf) == qinfo->qname)
+			sldns_buffer_skip(buf, (ssize_t)qinfo->qname_len);
+		else	sldns_buffer_write(buf, qinfo->qname, qinfo->qname_len);
+		sldns_buffer_write_u16(buf, qinfo->qtype);
+		sldns_buffer_write_u16(buf, qinfo->qclass);
+		sldns_buffer_write_u16(buf, 0);
+		// TTL. Should we make this configurable too?
+		sldns_buffer_write_u16(buf, 5);
+		sldns_buffer_write_u16(buf, addr_len);
+		sldns_buffer_write(buf, addr_data, addr_len);
+		fflush(stderr);
+	}
+	sldns_buffer_flip(buf);
+	if(edns) {
+		struct edns_data es = *edns;
+		es.edns_version = EDNS_ADVERTISED_VERSION;
+		es.udp_size = EDNS_ADVERTISED_SIZE;
+		es.ext_rcode = 0;
+		es.bits &= EDNS_DO;
+		if(sldns_buffer_limit(buf) + calc_edns_field_size(&es) >
+			edns->udp_size)
+			return;
+		attach_edns_record(buf, &es);
+	}
+}
Index: util/data/msgencode.h
===================================================================
--- util/data/msgencode.h	(revision 4191)
+++ util/data/msgencode.h	(working copy)
@@ -128,4 +128,20 @@
 void error_encode(struct sldns_buffer* pkt, int r, struct query_info* qinfo,
 	uint16_t qid, uint16_t qflags, struct edns_data* edns);
 
+/**
+ * Encode a fixed address response.
+ * This is a fake answer to either an A or AAA query
+ *
+ * It will answer with that address
+ *
+ * @param pkt: where to store the packet.
+ * @param r: RCODE value to encode.
+ * @param qinfo: if not NULL, the query is included.
+ * @param qid: query ID to set in packet. network order.
+ * @param qflags: original query flags (to copy RD and CD bits). host order.
+ * @param edns: if not NULL, this is the query edns info,
+ * 	and an edns reply is attached. Only attached if EDNS record fits reply.
+ */
+void fixed_address_encode(struct sldns_buffer* pkt, int r, struct query_info* qinfo,
+	uint16_t qid, uint16_t qflags, struct edns_data* edns, char* address);
 #endif /* UTIL_DATA_MSGENCODE_H */