diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index f426ac5f..147fbfa9 100644
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -872,6 +872,13 @@ potentially broken nameservers. A lot of domains will not be resolvable when
 this option in enabled. Only use if you know what you are doing.
 This option only has effect when qname-minimisation is enabled. Default is no.
 .TP
+.B aaaa\-filter: \fI<yes or no>
+Activate behavior similar to BIND's AAAA-filter.
+This forces the dropping of all AAAA records, unless in the case of
+explicit AAAA queries, when no A records have been confirmed.
+This also causes an additional A query to be sent for each AAAA query.
+This breaks DNSSEC!
+.TP
 .B aggressive\-nsec: \fI<yes or no>
 Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
 and other denials, using information from previous NXDOMAINs answers.
diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c
index aae934dd..55c55de0 100644
--- a/iterator/iter_scrub.c
+++ b/iterator/iter_scrub.c
@@ -667,6 +667,32 @@ static int sanitize_nsec_is_overreach(struct rrset_parse* rrset,
 	return 0;
 }
 
+/**
+ * ASN: Lookup A records from rrset cache.
+ * @param qinfo: the question originally asked.
+ * @param env: module environment with config and cache.
+ * @param ie: iterator environment with private address data.
+ * @return 0 if no A record found, 1 if A record found.
+ */
+static int
+asn_lookup_a_record_from_cache(struct query_info* qinfo,
+	struct module_env* env, struct iter_env* ATTR_UNUSED(ie))
+{
+	struct ub_packed_rrset_key* akey;
+
+	/* get cached A records for queried name */
+	akey = rrset_cache_lookup(env->rrset_cache, qinfo->qname,
+		qinfo->qname_len, LDNS_RR_TYPE_A, qinfo->qclass,
+		0, *env->now, 0);
+	if(akey) { /* we had some. */
+		log_rrset_key(VERB_ALGO, "ASN-AAAA-filter: found A record",
+			      akey);
+		lock_rw_unlock(&akey->entry.lock);
+		return 1;
+	}
+	return 0;
+}
+
 /**
  * Given a response event, remove suspect RRsets from the response.
  * "Suspect" rrsets are potentially poison. Note that this routine expects
@@ -686,6 +712,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
 	struct iter_env* ie)
 {
+	int found_a_record = 0; /* ASN: do we have a A record? */
 	int del_addi = 0; /* if additional-holding rrsets are deleted, we
 		do not trust the normalized additional-A-AAAA any more */
 	struct rrset_parse* rrset, *prev;
@@ -721,6 +748,13 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 		rrset = rrset->rrset_all_next;
 	}
 
+	/* ASN: Locate any A record we can find */
+	if((ie->aaaa_filter) && (qinfo->qtype == LDNS_RR_TYPE_AAAA)) {
+		found_a_record = asn_lookup_a_record_from_cache(qinfo,
+			env, ie);
+	}
+	/* ASN: End of added code */
+
 	/* At this point, we brutally remove ALL rrsets that aren't 
 	 * children of the originating zone. The idea here is that, 
 	 * as far as we know, the server that we contacted is ONLY 
@@ -732,6 +766,24 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	rrset = msg->rrset_first;
 	while(rrset) {
 
+		/* ASN: For AAAA records only... */
+		if((ie->aaaa_filter) && (rrset->type == LDNS_RR_TYPE_AAAA)) {
+			/* ASN: If this is not a AAAA query, then remove AAAA
+			 * records, no questions asked. If this IS a AAAA query
+			 * then remove AAAA records if we have an A record.
+			 * Otherwise, leave things be. */
+			if((qinfo->qtype != LDNS_RR_TYPE_AAAA) ||
+				(found_a_record)) {
+				remove_rrset("ASN-AAAA-filter: removing AAAA "
+					"for record", pkt, msg, prev, &rrset);
+				continue;
+			}
+			log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: "
+				"keep AAAA for", zonename,
+				LDNS_RR_TYPE_AAAA, qinfo->qclass);
+		}
+		/* ASN: End of added code */
+
 		/* remove private addresses */
 		if( (rrset->type == LDNS_RR_TYPE_A || 
 			rrset->type == LDNS_RR_TYPE_AAAA)) {
diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c
index 7bc67da6..e10f547a 100644
--- a/iterator/iter_utils.c
+++ b/iterator/iter_utils.c
@@ -175,6 +175,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 	}
 	iter_env->supports_ipv6 = cfg->do_ip6;
 	iter_env->supports_ipv4 = cfg->do_ip4;
+	iter_env->aaaa_filter = cfg->aaaa_filter;
	iter_env->outbound_msg_retry = cfg->outbound_msg_retry;
 	return 1;
 }
diff --git a/iterator/iterator.c b/iterator/iterator.c
index 23b07ea9..ca29b48c 100644
--- a/iterator/iterator.c
+++ b/iterator/iterator.c
@@ -2127,6 +2127,53 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id)
 
 	return 0;
 }
+
+/**
+ * ASN: This event state was added as an intermediary step between
+ * QUERYTARGETS_STATE and the next step, in order to cast a subquery for the
+ * purpose of caching A records for the queried name.
+ *
+ * @param qstate: query state.
+ * @param iq: iterator query state.
+ * @param ie: iterator shared global environment.
+ * @param id: module id.
+ * @return true if the event requires more request processing immediately,
+ *         false if not. This state only returns true when it is generating
+ *         a SERVFAIL response because the query has hit a dead end.
+ */
+static int
+asn_processQueryAAAA(struct module_qstate* qstate, struct iter_qstate* iq,
+	struct iter_env* ATTR_UNUSED(ie), int id)
+{
+	struct module_qstate* subq = NULL;
+
+	log_assert(iq->fetch_a_for_aaaa == 0);
+
+	/* flag the query properly in order to not loop */
+	iq->fetch_a_for_aaaa = 1;
+
+	/* re-throw same query, but with a different type */
+	if(!generate_sub_request(iq->qchase.qname,
+		iq->qchase.qname_len, LDNS_RR_TYPE_A,
+		iq->qchase.qclass, qstate, id, iq,
+		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1, 0)) {
+		log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: failed "
+			"preloading of A record for",
+			iq->qchase.qname, LDNS_RR_TYPE_A,
+			iq->qchase.qclass);
+		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+	}
+	log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: "
+		"preloading records in cache for",
+		iq->qchase.qname, LDNS_RR_TYPE_A,
+		iq->qchase.qclass);
+
+	/* set this query as waiting */
+	qstate->ext_state[id] = module_wait_subquery;
+	/* at this point break loop */
+	return 0;
+}
+/* ASN: End of added code */
 	
 /** 
  * This is the request event state where the request will be sent to one of
@@ -2186,6 +2233,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 	
+	/* ASN: If we have a AAAA query, then also query for A records */
+	if((ie->aaaa_filter) && (iq->qchase.qtype == LDNS_RR_TYPE_AAAA) &&
+		(iq->fetch_a_for_aaaa == 0)) {
+		return next_state(iq, ASN_FETCH_A_FOR_AAAA_STATE);
+	}
+	/* ASN: End of added code */
+
 	/* Make sure we have a delegation point, otherwise priming failed
 	 * or another failure occurred */
 	if(!iq->dp) {
@@ -3574,6 +3628,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 	return 0;
 }
 
+/**
+ * ASN: Do final processing on responses to A queries originated from AAAA
+ * queries. Events reach this state after the iterative resolution algorithm
+ * terminates.
+ * This is required down the road to decide whether to scrub AAAA records
+ * from the results or not.
+ *
+ * @param qstate: query state.
+ * @param id: module id.
+ * @param forq: super query state.
+ */
+static void
+asn_processAAAAResponse(struct module_qstate* qstate, int id,
+	struct module_qstate* super)
+{
+	/*struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];*/
+	struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id];
+	struct delegpt_ns* dpns = NULL;
+	int error = (qstate->return_rcode != LDNS_RCODE_NOERROR);
+
+	log_assert(super_iq->fetch_a_for_aaaa > 0);
+
+	/* let super go to evaluation of targets after this */
+	super_iq->state = QUERYTARGETS_STATE;
+
+	log_query_info(VERB_ALGO, "ASN-AAAA-filter: processAAAAResponse",
+		&qstate->qinfo);
+	log_query_info(VERB_ALGO, "ASN-AAAA-filter: processAAAAResponse super",
+		&super->qinfo);
+
+	if(super_iq->dp)
+		dpns = delegpt_find_ns(super_iq->dp,
+			qstate->qinfo.qname, qstate->qinfo.qname_len);
+	if (!dpns) {
+		/* not interested */
+		verbose(VERB_ALGO, "ASN-AAAA-filter: subq: %s, but parent not "
+			"interested%s", (error ? "error, but" : "success"),
+			(super_iq->dp ? "anymore" : " (was reset)"));
+		log_query_info(VERB_ALGO, "ASN-AAAA-filter: superq", &super->qinfo);
+		if(super_iq->dp && error)
+			delegpt_log(VERB_ALGO, super_iq->dp);
+		return;
+	} else if (error) {
+		verbose(VERB_ALGO, "ASN-AAAA-filter: mark as failed, "
+			"and go to target query.");
+		/* see if the failure did get (parent-lame) info */
+		if(!cache_fill_missing(super->env,
+			super_iq->qchase.qclass, super->region,
+			super_iq->dp))
+		log_err("ASN-AAAA-filter: out of memory adding missing");
+		dpns->resolved = 1; /* mark as failed */
+	}
+}
+/* ASN: End of added code */
+
 /*
  * Return priming query results to interested super querystates.
  * 
@@ -3593,6 +3702,9 @@ iter_inform_super(struct module_qstate* qstate, int id,
 	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
 		super->minfo[id])->state == DSNS_FIND_STATE)
 		processDSNSResponse(qstate, id, super);
+	else if (super->qinfo.qtype == LDNS_RR_TYPE_AAAA && ((struct iter_qstate*)
+		super->minfo[id])->state == ASN_FETCH_A_FOR_AAAA_STATE)
+		asn_processAAAAResponse(qstate, id, super);
 	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
 		error_supers(qstate, id, super);
 	else if(qstate->is_priming)
@@ -3630,6 +3742,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
 			case INIT_REQUEST_3_STATE:
 				cont = processInitRequest3(qstate, iq, id);
 				break;
+			case ASN_FETCH_A_FOR_AAAA_STATE:
+				cont = asn_processQueryAAAA(qstate, iq, ie, id);
+				break;
 			case QUERYTARGETS_STATE:
 				cont = processQueryTargets(qstate, iq, ie, id);
 				break;
@@ -3961,6 +4076,8 @@ iter_state_to_string(enum iter_state state)
 		return "INIT REQUEST STATE (stage 2)";
 	case INIT_REQUEST_3_STATE:
 		return "INIT REQUEST STATE (stage 3)";
+	case ASN_FETCH_A_FOR_AAAA_STATE:
+		return "ASN_FETCH_A_FOR_AAAA_STATE";
 	case QUERYTARGETS_STATE :
 		return "QUERY TARGETS STATE";
 	case PRIME_RESP_STATE :
@@ -3985,6 +4102,7 @@ iter_state_is_responsestate(enum iter_state s)
 		case INIT_REQUEST_STATE :
 		case INIT_REQUEST_2_STATE :
 		case INIT_REQUEST_3_STATE :
+		case ASN_FETCH_A_FOR_AAAA_STATE :
 		case QUERYTARGETS_STATE :
 		case COLLECT_CLASS_STATE :
 			return 0;
diff --git a/iterator/iterator.h b/iterator/iterator.h
index 342ac207..731948d1 100644
--- a/iterator/iterator.h
+++ b/iterator/iterator.h
@@ -135,6 +135,9 @@ struct iter_env {
 	 */
 	int* target_fetch_policy;
 
+	/** ASN: AAAA-filter flag */
+	int aaaa_filter;
+
 	/** lock on ratelimit counter */
 	lock_basic_type queries_ratelimit_lock;
 	/** number of queries that have been ratelimited */
@@ -186,6 +189,14 @@ enum iter_state {
 	 */
 	INIT_REQUEST_3_STATE,
 
+	/**
+	 * This state is responsible for intercepting AAAA queries,
+	 * and launch a A subquery on the same target, to populate the
+	 * cache with A records, so the AAAA filter scrubbing logic can
+	 * work.
+	 */
+	ASN_FETCH_A_FOR_AAAA_STATE,
+
 	/**
 	 * Each time a delegation point changes for a given query or a 
 	 * query times out and/or wakes up, this state is (re)visited. 
@@ -375,6 +386,13 @@ struct iter_qstate {
 	 */
 	int refetch_glue;
 
+	/**
+	 * ASN: This is a flag that, if true, means that this query is
+	 * for fetching A records to populate cache and determine if we must
+	 * return AAAA records or not.
+	 */
+	int fetch_a_for_aaaa;
+
 	/** list of pending queries to authoritative servers. */
 	struct outbound_list outlist;
 
diff --git a/pythonmod/interface.i b/pythonmod/interface.i
index f08b575d..47f1bb2e 100644
--- a/pythonmod/interface.i
+++ b/pythonmod/interface.i
@@ -975,6 +975,7 @@ struct config_file {
    int harden_dnssec_stripped;
    int harden_referral_path;
    int use_caps_bits_for_id;
+   int aaaa_filter; /* ASN */
    struct config_strlist* private_address;
    struct config_strlist* private_domain;
    size_t unwanted_threshold;
diff --git a/util/config_file.c b/util/config_file.c
index 0ab8614a..729fb147 100644
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -218,6 +218,7 @@ config_create(void)
 	cfg->harden_referral_path = 0;
 	cfg->harden_algo_downgrade = 0;
 	cfg->use_caps_bits_for_id = 0;
+	cfg->aaaa_filter = 0; /* ASN: default is disabled */
 	cfg->caps_whitelist = NULL;
 	cfg->private_address = NULL;
 	cfg->private_domain = NULL;
diff --git a/util/config_file.h b/util/config_file.h
index e61257a3..dabaa7bb 100644
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -260,6 +260,8 @@ struct config_file {
 	int harden_algo_downgrade;
 	/** use 0x20 bits in query as random ID bits */
 	int use_caps_bits_for_id;
+	/** ASN: enable AAAA filter? */
+	int aaaa_filter;
 	/** 0x20 whitelist, domains that do not use capsforid */
 	struct config_strlist* caps_whitelist;
 	/** strip away these private addrs from answers, no DNS Rebinding */
diff --git a/util/configlexer.lex b/util/configlexer.lex
index 79a0edca..4eaec678 100644
--- a/util/configlexer.lex
+++ b/util/configlexer.lex
@@ -304,6 +304,7 @@ harden-algo-downgrade{COLON}	{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
 use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 caps-whitelist{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
 unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
+aaaa-filter{COLON}		{ YDVAR(1, VAR_AAAA_FILTER) }
 private-address{COLON}		{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
 private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
 prefetch-key{COLON}		{ YDVAR(1, VAR_PREFETCH_KEY) }
diff --git a/util/configparser.y b/util/configparser.y
index 1d0e8658..f284dd43 100644
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -97,6 +97,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT 
 %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
 %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
+%token VAR_AAAA_FILTER
 %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
 %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
 %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
@@ -244,6 +244,7 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
 	server_harden_referral_path | server_private_address |
 	server_private_domain | server_extended_statistics |
+	server_aaaa_filter |
 	server_local_data_ptr | server_jostle_timeout |
 	server_unwanted_reply_threshold | server_log_time_ascii |

@@ -1742,6 +1744,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG
 			yyerror("out of memory");
 	}
 	;
+server_aaaa_filter: VAR_AAAA_FILTER STRING_ARG
+	{
+		OUTYY(("P(server_aaaa_filter:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->aaaa_filter = (strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG
 	{
 		OUTYY(("P(server_private_address:%s)\n", $2));
