Not sure which one is safer but I have read in many places that using NXDOMAIN is a lot faster then 127.0.0.1/0.0.0.0 because with NXDOMAIN you get 'fail' instantly while with 127.0.0.1/0.0.0.0 you need to wait for connection timeout.

Thanks for the link, will look into it.