bind9: forward *every* NXDOMAIN to a different nameserver even if zone locally known

Currently I'm using the "hosts" file for this, but that's getting harder to maintain over multiple workstations... I'd like to setup a nameserver in our local network which can overwrite or append hosts to existing domains. Eg. sql.ourdomain.tld is defined in the "master dns" SOA dns.ourdomain.tld with IN A 80.90.100.200 and I like to overwrite it with IN A 192.168.15.5 in our local nameserver. So its "answer locally first, forward every NXDOMAIN to a different resolver" I guess there is such a solution because "pihole" does similar things.