Don't just blindly use the first custom NS entry for SOA, actually check if it pertains to the domain in question