@feld @nuintari I think you have to make it return NXDOMAIN for example.
"The result will be considered negative if:
A response code other than NOERROR is returned, such as NXDOMAIN (non-existent domain) or SERVFAIL.
A NOERROR response code is returned, but contains neither A nor AAAA records.
The result will be considered positive if the query completes with NOERROR and contains A or AAAA records (or both).
A negative result will be a signal to disable application DNS, (i.e., DoH)."