Don't recurse if the question name matches the resolver suffix.

[turbomaze]

Before

If the deployed resolver had a resolver suffix of a.b, then querying *(a.b.)+ could cause problems.

After

Instead of replacing just the suffix, we replace all ${suffix}+$. Then, in the case of a query that results in a recursive cycle, we don't bother generating an answer and just send an SOA. Another nameserver layer in front of the handshake resolver handles serving NS records for the zone, so only other question types will hit this empty response SOA.