NXDOMAIN at least has a TTL so it will not grow forever. What problem are you referring to, not being able to invalidate a cached NXDOMAIN? Or something else?
Yeah, well, if the TTL in the SOA were being respected it wouldn't be a problem. Tomorrow we're going to run some experiments to find out which godforsaken layer of "smart" infrastructure is responsible.