Only use stale dns cache entries when the query result was successful

service/resolver/resolve.go

@@ -184,7 +184,7 @@ func Resolve(ctx context.Context, q *Query) (rrCache *RRCache, err error) {
 			case !rrCache.Expired():
 				// Return non-expired cached entry immediately.
 				return rrCache, nil
-			case useStaleCache():
+			case rrCache.RCode == dns.RcodeSuccess && useStaleCache():
 				// Return expired cache if we should use stale cache entries,
 				// but start an async query instead.
 				log.Tracer(ctx).Tracef(