[RPZ] marking packets modified by DNS-RPZ-policy

[Paul Vixie]

i can't think of a way to do this marking that won't look like a kashpureff
attack to any downstream recursives that use the rpz server as a forwarder.

so, putting an RR into the additional section, like

"HIT._RPZ. 0 IN RP 0 RPZ.VIX.COM."

seems like an obvious and wonderful thing until you look at the syslog files
on the people downstream of you.