> In the general case it's probably best to give a protocolly reasonable and > short response, such as SERVFAIL or REFUSED. i always liked sending a root referral in this case, which ought to trigger the lame-delegation detection that all of these full resolvers have to have.