Heh, this is a fairly easy mistake to make when implementing a DNS server. I’m the person that had to fix this very same bug (and possibly introduced it) for a certain class of domains in the Cloudflare DNS server. “Empty non-terminal” still has an emotional reaction attached to it. :)

Also, pretending all NXDOMAINs are actually empty non-terminals is a backwards compatible hack to compress DNSSEC responses https://tools.ietf.org/html/draft-valsorda-dnsop-black-lies-...