>Yep - you're only allowed SOA, apex NS, glue, DNSSEC records and >delegations - nothing else. That's at the apex of the TLD. By my count _whois._tcp.tld is two levels down. R's, John PS: What threat model do people believe is enabled by _tcp?