Hello I thought about avoiding dns queries for hidden services being sent to the isp dns server, and configured bind9 so that it answered all .onion queries with nxdomain, in case the proxy fails. Details are at the bottom of https://wiki.torproject.org/noreply/TheOnionRouter/Preventing_Tor_DNS_Leaks#preview I hope you find this information useful.