always add SOA to apex matching NSECx records

post 1dfd8ad SOA can live outside the records table