I have one valid subdomain on my site; it and the main domain work. But I was wondering, what if someone enters a bogus subdomain?

I have a rule like this:

# throw away all other subdomains
server {
  server_name ~^(.*)\.foo\.to$ ;

  return 301 https://foo.to/notfound;
}

I thought this would fix the problem but instead the browser complains: DNS address could not be found.

Sure, I suppose that makes sense. But why is it that when I go to a non-existent GitHub Pages subdomain (https://adfljaslfdjalsfdkjalfgsjklakfgjlajrgiajeroigjtaoi4jto.github.io/), that does send a 404? How do I emulate that?