Reverse DNS is blocked with NXDOMAIN instead of 0.0.0.0

All blacklisted domains from custom rules are blocked with 0.0.0.0, as expected, but rule that blocks in-addr reverse DNS results in NXDOMAIN reponse. Why? How to force 0.0.0.0 response for all in-addr queries?

EDIT: Actually, sometimes response is NXDOMAIN and other times its 0.0.0.0. Whenever I use NSLOOKUP to test in-addr addresses, response is the correct one - 0.0.0.0, but during WAN attacks (detected by router's IPS/IDS), AGH shows localhost trying resolve rDNS addresses for selected upsteam DoH servers with NXDOMAIN response. It also happens when I switch ISP gateway from NAT router mode to bridged mode, but AGH is not exposed to WAN, only LAN.

BTW, does AGH have any anti-DDoS measures? DNS reflection attacks are difficult to withstand.