Return NXDOMAIN when we don't have entries, and drop the non-authoritative special case for recursive dns.

nameserver/dns.go

@@ -135,6 +135,10 @@ func (d *DNSServer) handleLocal(defaultMaxResponseSize int) func(dns.ResponseWri
 		}
 
 		addrs := d.ns.Lookup(hostname)
+		if len(addrs) == 0 {
+			d.errorResponse(req, dns.RcodeNameError, w)
+			return
+		}
 
 		response := dns.Msg{}
 		response.RecursionAvailable = true
@@ -234,10 +238,6 @@ func (d *DNSServer) handleRecursive(client *dns.Client, defaultMaxResponseSize i
 				d.ns.debugf("error trying %s: %v", server, err)
 				continue
 			}
-			if response.Rcode != dns.RcodeSuccess && !response.Authoritative {
-				d.ns.debugf("non-authoritative error trying %s: %v", server, response.Rcode)
-				continue
-			}
 			d.ns.debugf("response: %+v", response)
 			response.SetReply(req)
 			if err := w.WriteMsg(response); err != nil {