NXDOMAIN really means there is nothing underneath
AFNIC
Verisign labs
This document states clearly that when a DNS resolver receives a response with response code NXDOMAIN, it means that the name in the question section AND ALL THE NAMES UNDER IT do not exist. REMOVE BEFORE PUBLICATION: this document should be discussed in the IETF DNSOP (DNS Operations) group, through its mailing list. The source of the document, as well as a list of open issues, is currently kept at Github [1].