[profmonocle]

What's especially weird is that they're returning "127.0.0.3" to Cloudflare's DNS, rather than a DNS SERVFAIL or REFUSED error. On most systems that will cause a connection refused error or a TCP timeout. I would assume that was a network issue on their end, not a DNS problem.

[majewsky]

SERVFAIL or REFUSED is also not helpful to the end user. They should return the IP of a host serving a static single-page website explaining the issue.

[zamadatix]

REFUSED will trigger a lookup on the next DNS server in the list, which may not be Cloudflare, instead of guaranteeing the user can't go to the real page.