Seems to work here. Looking up something that is on DROP, it returns: dig -t A 0.176.58.2.zen.spamhaus.org ; <<>> DiG 9.11.5-P4-5.1+deb10u3-Debian <<>> -t A 0.176.58.2.zen.spamhaus.org ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13958 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ;; QUESTION SECTION: ;0.176.58.2.zen.spamhaus.org. IN A ;; ANSWER SECTION: 0.176.58.2.zen.spamhaus.org. 60 IN A 127.0.0.2 0.176.58.2.zen.spamhaus.org. 60 IN A 127.0.0.9 ;; Query time: 304 msec ;; SERVER: 1.1.1.2#53(1.1.1.2) ;; WHEN: Tue Apr 20 22:32:00 +07 2021 ;; MSG SIZE rcvd: 88 Looking up something that is clean returns NXDOMAIN, looking up something that is not clean returns the appropriate record. I think there is no AAAA, A, CNAME for zen.spamhaus.org itself.