How do you build an irule to drop connection (without completing the handshake)

Arie is right. Most DNS client implementations will only return a single IP address so they would only try the first address. If your second address managed by the same LTM or in the same datacenter, you might be better off changing your pool to use priority groups so your failover address (or destinations) are in the existing pool but only accessed if all others are down.