dnsmasq – Unbound: How to intercept domain without any dots?

In dnsmasq, settings domain-needed and address=// could both return NXDOMAIN results to prevent forwarding domain without any dot or domain part.

Is there any solution in unbound? I tried local-zone: "." always_nxdomain, while "." seems to match any/all domain.