SafeSearch DuckDuckGo images won't load

[mrtumnus]

pfBlockerNG's safe search feature includes a local-zone for duckduckgo.com, which redirects all subdomain queries to safe.duckduckgo.com (52.149.247.1):

local-zone: "duckduckgo.com" redirect local-data: "duckduckgo.com 300 IN CNAME safe.duckduckgo.com"

However, DuckDuckGo has (recently?) a separate CDN for image search results, external-content.duckduckgo.com (52.149.246.247). These images do not load through the safe.duckduckgo.com server:

This safe-search redirect needs to be retooled somehow to support the external content server. I tried adding a separate local-data override, but this broke unbound (can't have a local-data inside a local-zone redirect, I guess):

local-data: "external-content.duckduckgo.com A 52.149.246.247"

Any suggestions for a workaround? Maybe it's time for an RPZ or stub zone. I'm not as familiar with these approaches.