The ns_client_aclchecksilent is used to check multiple ACLs before the decision is made that a query is denied. It is also used to determine if recursion is available. In those cases we should not set the extended DNS error "Prohibited".