Cache negative results, too, but only with half TTL, as configured. Plus get rid of "mesg.Id = req.Id" data race (build with -race flag) at once without locking. Found another data race: delete must be protected with Lock, RLock is not enough.
For example Consul uses port 8600. With this patch, I can add nameserver 127.0.0.1#8600 to my godns-specific resolv.conf.