Two of their servers were sending out NXDOMAINs which are then cached by downstream forwarders. It seems they have turned those off now.