DNAME don't sign the synthesised CNAME

fixes #1360