F5 iRule to filter out DNS queries going out to Internet

I am looking for an iRule to implement the below scenario:

When a user from a particular subnet make DNS queries, he should get only get response for internal zones and should get NXDOMAIN for all internet based queries (External Zones).

Regards,