make superfluous 'bind' NSEC3 record optional