broken 'apex' NSEC3 for ma. denies big number of delegated names

[Stephane Bortzmeyer]

On Tue, Oct 06, 2026 at 01:07:18AM +1100,
 Viktor Dukhovni <ietf-dane at dukhovni.org> wrote 
 a message of 32 lines which said:

> > One example is bankalmaghrib.ma.:
> 
> And indeed that lies in the excluded range:
> 
>     $ ldns-nsec3-hash -t 10 -s 4f6e444c70554fbafbb2 bankalmaghrib.ma
>     qh1m00s34qt97cbgrdmln64s86j39crq.

And the problem, as seen by the DNS resolvers of the RIPE Atlas probes:

% blaeu-resolve -r 100 --type CNAME www.bankalmaghrib.ma
[www.bkam.ma.] : 92 occurrences 
[ERROR: NXDOMAIN] : 7 occurrences 
Test #219078014 done at 2026-10-05T15:37:09Z
Results on atlas.ripe.net : https://atlas.ripe.net/measurements/219078014