answer direct NSEC queries without DO bit