Setting cache max-age to 0 has no effect on Block built using BlockBase?
This is a known problem for anonymous requests, see this issue PageCache caching uncacheable responses (violating HTTP/1.0 spec) + D8 intentionally disabling HTTP/1.0 proxies = WTF.

Until this is resolved, put this trigger in your block build():

\Drupal::service('page_cache_kill_switch')-&gt;trigger();