[zamadatix]

REFUSED will trigger a lookup on the next DNS server in the list, which may not be Cloudflare, instead of guaranteeing the user can't go to the real page.