send extra NSEC3 because old BIND9 needs it, closes #814