Determining case of REFUSED queries

[tale]

On Thu, Oct 3, 2024 at 6:23 PM Lyle Giese via bind-users
<bind-users at lists.isc.org> wrote:
> I get this:
> ; <<>> DiG 9.16.50-Debian <<>> ns socialinnovation.ca
>...
> socialinnovation.ca.    3600    IN      NS      dns.rebel.ca.
> socialinnovation.ca.    3600    IN      NS      sean.ns.cloudflare.com.
> socialinnovation.ca.    3600    IN      NS      kami.ns.cloudflare.com.
> socialinnovation.ca.    3600    IN      NS      dns2.rebel.ca.
>...>
> But a whois query for this domain only lists dns.rebel.ca and dns2.rebel.ca for name servers.

The Cloudflare NSs are coming from the apex NS RRset as returned by rebel.ca.

> Wonder if the cloudflare server are not getting a good axfr from the rebel.ca servers or something else is wrong.

REFUSED would tend to indicate that Cloudflare is just not configured
for the zone at all.
-- 
tale