[xz53]

> ...requests up the tree

That's right, it's not recursively working its way down from the root because it's a stub resolver.

[tptacek]

I give up. You win. DNSSEC is the perfect solution for forged NXDOMAIN responses.