I have a RPZ configuration with positive answers.

Right, thank you.  I forgot we even put this way into documentation.

(This genRR is not what I'd call a simple way, but on the other hand it's very flexible, if you know the DNS protocol a bit.)

--Vladimir