Possible To Log NXDOMAIN At The Server?

[Reineman, Rick]

Hello, I recently migrated our internal DNS service to a newer OS and Bind.  Bind 9.9.4 on CentOS7.  

The previous service had a dataset that was in really bad shape and I did a lot of cleanup for the migration.  Unfortunately there were a few records I dropped that I should not have, but it's hard to figure out which until someone complains.

I am interested in capturing queries that fail, return a NXDOMAIN to the client in other words.

I have two logging categories setup "queries" and "query-errors", both going to separate logs.

The problem is that the logs do not log what I am interested in.  The queries log, logs every query, the query-errors log supposedly only logs a SERVFAIL.

Does anyone know if it is possible to get what I want from the DNS server?

Thanks,
Rick