don't check auth. bit on NXDOMAIN/noanswer (ready for neg. caching);