diff --git a/command/agent/dns.go b/command/agent/dns.go
index cb20b18ddcc5..15c343228d31 100644
--- a/command/agent/dns.go
+++ b/command/agent/dns.go
@@ -336,6 +336,7 @@ PARSE:
 	return
 INVALID:
 	d.logger.Printf("[WARN] dns: QName invalid: %s", qName)
+	d.addSOA(d.domain, resp)
 	resp.SetRcode(req, dns.RcodeNameError)
 }
 
@@ -373,6 +374,7 @@ RPC:
 
 	// If we have no address, return not found!
 	if out.NodeServices == nil {
+		d.addSOA(d.domain, resp)
 		resp.SetRcode(req, dns.RcodeNameError)
 		return
 	}
@@ -478,6 +480,7 @@ RPC:
 
 	// If we have no nodes, return not found!
 	if len(out.Nodes) == 0 {
+		d.addSOA(d.domain, resp)
 		resp.SetRcode(req, dns.RcodeNameError)
 		return
 	}
diff --git a/command/agent/dns_test.go b/command/agent/dns_test.go
index 46e0dd40f229..f18818d5d9c7 100644
--- a/command/agent/dns_test.go
+++ b/command/agent/dns_test.go
@@ -173,6 +173,28 @@ func TestDNS_NodeLookup(t *testing.T) {
 	if aRec.Hdr.Ttl != 0 {
 		t.Fatalf("Bad: %#v", in.Answer[0])
 	}
+
+	// lookup a non-existing node, we should receive a SOA
+	m = new(dns.Msg)
+	m.SetQuestion("nofoo.node.dc1.consul.", dns.TypeANY)
+
+	c = new(dns.Client)
+	in, _, err = c.Exchange(m, addr.String())
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	if len(in.Ns) != 1 {
+		t.Fatalf("Bad: %#v", in, len(in.Answer))
+	}
+
+	soaRec, ok := in.Ns[0].(*dns.SOA)
+	if !ok {
+		t.Fatalf("Bad: %#v", in.Ns[0])
+	}
+	if soaRec.Hdr.Ttl != 0 {
+		t.Fatalf("Bad: %#v", in.Ns[0])
+	}
 }
 
 func TestDNS_CaseInsensitiveNodeLookup(t *testing.T) {
@@ -542,6 +564,29 @@ func TestDNS_ServiceLookup(t *testing.T) {
 	if aRec.Hdr.Ttl != 0 {
 		t.Fatalf("Bad: %#v", in.Extra[0])
 	}
+
+	// lookup a non-existing service, we should receive a SOA
+	m = new(dns.Msg)
+	m.SetQuestion("nodb.service.consul.", dns.TypeSRV)
+
+	c = new(dns.Client)
+	addr, _ = srv.agent.config.ClientListener("", srv.agent.config.Ports.DNS)
+	in, _, err = c.Exchange(m, addr.String())
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	if len(in.Ns) != 1 {
+		t.Fatalf("Bad: %#v", in)
+	}
+
+	soaRec, ok := in.Ns[0].(*dns.SOA)
+	if !ok {
+		t.Fatalf("Bad: %#v", in.Ns[0])
+	}
+	if soaRec.Hdr.Ttl != 0 {
+		t.Fatalf("Bad: %#v", in.Ns[0])
+	}
 }
 
 func TestDNS_ServiceLookup_ServiceAddress(t *testing.T) {
@@ -1771,3 +1816,34 @@ func TestDNS_ServiceLookup_FilterACL(t *testing.T) {
 		t.Fatalf("Bad: %#v", in)
 	}
 }
+
+func TestDNS_NonExistingLookup(t *testing.T) {
+	dir, srv := makeDNSServer(t)
+	defer os.RemoveAll(dir)
+	defer srv.agent.Shutdown()
+
+	addr, _ := srv.agent.config.ClientListener("", srv.agent.config.Ports.DNS)
+
+	// lookup a non-existing node, we should receive a SOA
+	m := new(dns.Msg)
+	m.SetQuestion("nonexisting.consul.", dns.TypeANY)
+
+	c := new(dns.Client)
+	in, _, err := c.Exchange(m, addr.String())
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	if len(in.Ns) != 1 {
+		t.Fatalf("Bad: %#v", in, len(in.Answer))
+	}
+
+	soaRec, ok := in.Ns[0].(*dns.SOA)
+	if !ok {
+		t.Fatalf("Bad: %#v", in.Ns[0])
+	}
+	if soaRec.Hdr.Ttl != 0 {
+		t.Fatalf("Bad: %#v", in.Ns[0])
+	}
+
+}