if you installed the first isc wildcard patch you probably want the second. see www.isc.org/products/BIND/delegation-only.html for details. the first patch didn't handle NS lookups (which don't occur in nature but it's sort of unnerving when they don't work in "dig"). in addition to the "type delegation-only" zones, the latest release candidate has an additional "root-delegation-only" option. this looks like: options { root-delegation-only exclude { "de"; "museum"; }; }; thus the delegation-only behaviour becomes the default for the root domain, and all tld's except those listed. DE has no wildcards but they do put customer A RRs into the DE zone itself. MUSEUM has a wildcard but this was part of their application and it was approved and has not been a problem. f.6to4-servers.net is now running this if you want to try before you, um, buy. thanks very much to the membership of the bind forum who make this possible. -- Paul Vixie