Feature request: instead of returning NXDOMAIN better drop requests for unknown records

Hi!

Since Letsencrypt officially states that you cannot limit your DNS server to certain client IP addresses by the means of a packet filter, I see a lot of requests by port scanners which are dutifully answered with NXDOMAIN.

I'd like a configurable option to drop the requests, i.e. not answer at all for anything unknown instead.

Kind regards,
Patrick