Draft: don't rewrite cached SOA records from negative answers
Currently there's only exception to avoid rewriting secure NS records. Most of the negative answers provide SOA record, so it's undesirable to keep rewriting it for every negative answer.
cc @anb
Edited by Vladimír Čunát