I noticed that, in case of a malicious domain name, some local resolvers send an NXDOMAIN and others a courtesy page address. Do you know if the resolvers (for example TIM, Wind or Fastweb) can return an NXDomain in order to protect their clients? 

Thanks a lot