return an empty slice for NXDOMAIN, rather than a nil slice