If you DNSSEC sign your domain then the NXDOMAIN would be rejected without associated NSEC records. .io has a DS record in the root-zone. At the very least cach

If you DNSSEC sign your domain then the NXDOMAIN would be rejected without associated NSEC records. .io has a DS record in the root-zone. At the very least caches would only be populated with the correct answer. This is of course assuming the lookups are done using a validating resolver.