This looks okay. I made a few stylistic tweaks (we already had macros for
checking ZEROTTL and NEGATIVE and I thought it would be more readable to
use them).

If there's an NXDOMAIN flood and we're getting a lot of negative records
put on this end of the list, will this in any way affect handling of the
ZEROTTL records that would've been there there before?