Bind9 Response Policy ignoring out-of-zone data

I'm trying to set up response policy on my existing Bind9 server because I'd like to override some of my company public domain to redirect them to our private network ips.

I've followed this tutorial : https://www.linuxbabe.com/ubuntu/set-up-response-policy-zone-rpz-in-bind-resolver-on-debian-ubuntu

However, I'm getting this error for the two domains I'm trying to override :

named[17104]: /etc/bind/zones/db.rpz:17: ignoring out-of-zone data (xxx.mydomain1.com)
named[17104]: /etc/bind/zones/db.rpz:19: ignoring out-of-zone data (yyy.mydomain2.com)
named[17104]: (re)loading policy zone 'rpz' changed from 0 to 2 qname, 0 to 0 nsdname, 0 to 0 IP, 0 to 0 NSIP, 0 to 0 CLIENTIP entries
named[17104]: zone rpz/IN: loaded serial 14

here's my configuration : named.conf.local :

zone "rpz" {
    type master;
    file "/etc/bind/zones/db.rpz";
    allow-transfer { IP_DNS2; };
};

named.conf.options :

options {
        ...OPTIONS...
        response-policy {
                zone "rpz";
        };
}

/etc/bind/zones/db.rpz :

;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     localhost.rpz. root.rpz. (
                              14         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;

@       IN      NS      localhost.rpz.

localhost.rpz.  A       127.0.0.1

xxx.mydomain.com.    A       PRIVATE_IP

yyy.mydomain2.com.      A       PRIVATE_IP

AFAIR LHS should NOT end in . in RPZ zone file.