dnsproxy: add non-fallback mode

doc/man/knot.conf.5in

@@ -1314,6 +1314,7 @@ mod\-dnsproxy:
   \- id: STR
     remote: remote_id
     timeout: INT
+    fallback: BOOL
     catch\-nxdomain: BOOL
 .ft P
 .fi
@@ -1333,10 +1334,17 @@ forwarded to.
 A remote response timeout in milliseconds.
 .sp
 \fIDefault:\fP 500
+.SS fallback
+.sp
+If enabled, localy unsatisfied queries leading to REFUSED (no zone) are forwarded.
+If disabled, all queries are directly forwarded without any local attempts
+to resolve them.
+.sp
+\fIDefault:\fP on
 .SS catch\-nxdomain
 .sp
-If enabled, all unsatisfied queries (also applies to local zone lookups)
-are forwarded.
+If enabled, localy unsatisfied queries leading to NXDOMAIN are forwarded.
+This option is only relevant in the fallback mode.
 .sp
 \fIDefault:\fP off
 .SH MODULE ROSEDB