check_dns reports bogus "connection refused" for "REFUSED" DNS responses

Running monitoring-plugins-standard 2.2-6ubuntu1.2 from Ubuntu 20.04 LTS (focal).

check_dns was failing as follows:

$ /usr/lib/nagios/plugins/check_dns -H localhost -a 127.0.0.1 -s 127.0.0.1
Connection to DNS 127.0.0.1 was refused
$ _

However, the nameserver is clearly working:

$ dig +short localhost 127.0.0.1
127.0.0.1
$ _

I straced check_dns and discovered that it was forking nslookup. Running nslookup directly reveals:

$ /usr/bin/nslookup -sil localhost 127.0.0.1
Server: 127.0.0.1
Address: 127.0.0.1#53

** server can't find localhost.openstack.lan: REFUSED

$ _

So it's not that the connection to the DNS server was refused, but the query itself was refused by the DNS server. These are very different cases.

A workaround is to change my nrpe check_dns command to query "localhost.".