Diagnose and debug bind server configuration lookup with exit line

I'm using dig with dig someserver.com -p 53 @localhost checking if my bind server do what it should. However even if I have a rpz set up with a wildcard like *.com A 127.0.0.1 most of .com replies correctly with 127.0.0.1 there are some domain.com that instead are resolved externally, let's say they strangely bypass the wildcard. The configuration is very big with a ton of voices, so I'm wondering if there's another rule that instead forwards externally the request. I wonder... there's a command that could help me to understand which rule make bind act in that specific way? eg. this host is resolved this way cause the rule at line 2421 of that file ?