don't ignore NXDOMAIN... fail