Hm.. I think I've narrowed it down to OpenDNS being the problematic resolver in this. My local nameserver forwards queries to a few different resolvers and the one that I can make return the bogus query is the OpenDNS one.