Implement "NXDOMAIN cut" (RFC 8020)
BIND has "NSEC aggressive caching" (NSEC-only, see #50) but this requires DNSSEC. For non-DNSSEC zones, "NXDOMAIN cut" could be interesting (RFC 8020).
It is already implemented in Unbound (option "harden-below-nxdomain:")
[Is there a tag "Resolver"? This could be useful for resolver-only features.]