rose: better nxdomain/referral behaviour, provide optional SOA if exists