don't rewrite cached SOA records from negative answers

Currently there's only exception to avoid rewriting secure NS records.
Most of the negative answers provide SOA record, so it's undesirable
to keep rewriting it for every negative answer.
in 8 minutes and 11 seconds and was queued for 10 seconds
latest