If your DNS server doesn't easily allow you to return an NXDOMAIN (the DNS server in Windows Server is this way, for example) you can also just create an empty

If your DNS server doesn't easily allow you to return an NXDOMAIN (the DNS server in Windows Server is this way, for example) you can also just create an empty zone for "use-application-dns.net". As long as no "A" or "AAAA" records are returned the conditions for the canary will be satisfied.