I would like to test if the issue persists with disabled qname minimization
I forgot to mention that the approach probably won't help. We still have a generic fallback that tries non-minimized QNAME instead of finishing with negative answer, and there are some additional cases when minimization gets turned off. I think it covers the typical issues, and it's also triggered in this case, as shown in subset of my verbose log:
[21597.06][iter] '_25._tcp.smtp-relay-in-s1.neusta.de.' type 'A' new uid was assigned .10, parent uid .00 [21597.10][resl] => id: '42106' querying: 'nis-dns-01.neusta-is.de.'@'185.48.220.2#00053' zone cut: 'neusta.de.' qname: 'SMTP-reLay-in-s1.NeusTA.De.' qtype: 'NS' proto: 'udp' [21597.10][iter] <= rcode: NOERROR [21597.10][iter] <= retrying with non-minimized name [21597.11][resl] => id: '44657' querying: 'nis-dns-01.neusta-is.de.'@'185.48.220.2#00053' zone cut: 'neusta.de.' qname: '_25._tcP.SMtP-reLay-iN-S1.NeUstA.dE.' qtype: 'A' proto: 'udp' [21597.11][iter] <= truncated response, failover to TCP [21597.12][resl] => id: '46774' querying: 'nis-dns-01.neusta-is.de.'@'185.48.220.2#00053' zone cut: 'neusta.de.' qname: '_25._tcP.SmTp-rElaY-IN-S1.nEusta.dE.' qtype: 'A' proto: 'tcp' [21597.12][iter] <= rcode: NXDOMAIN