Carl; > http://www.isc.org/products/BIND/delegation-only.html As I just post to DNSOP WG ML (detailed discussion should be done there), it is not an effective protection against synthesised (from wildcared NS, in this case) NS and synthesised (from scratch) child zone contents. A protection is to reject NS answers, if it is identical to wildcarded one, though it has several side effects. Masataka Ohta