dns: set error to REFUSED when there are no answers

modules/m_dns.cpp

@@ -854,6 +854,9 @@ class MyManager : public Manager, public Timer
 				}
 			}
 
+			if (packet->answers.empty() && packet->authorities.empty() && packet->additional.empty() && packet->error == ERROR_NONE)
+				packet->error = ERROR_REFUSED; // usually safe, won't cause an NXDOMAIN to get cached
+
 			s->Reply(packet);
 			return true;
 		}