Leyendo este post de Maximilan Dornseif en su blog, veo que el dominio .es permite transferencias de zona a desconocidos. Incrédulo, me pongo a probar:

peralta@daphne:~ $ dig NS es|grep -v ^\;|grep NS
es.                     3600    IN      NS      ns.uu.net.
es.                     3600    IN      NS      ns1.nic.es.
es.                     3600    IN      NS      ns1.cesca.es.
es.                     3600    IN      NS      ns2.nic.es.
es.                     3600    IN      NS      ns3.nic.fr.
es.                     3600    IN      NS      nso.nic.es.
es.                     3600    IN      NS      sun.rediris.es.
es.                     3600    IN      NS      aunic.aunic.net.
es.                     3600    IN      NS      sunic.sunet.se.
peralta@daphne:~ $ host -l es sunic.sunet.se
; Transfer failed.
Using domain server:
Name: sunic.sunet.se
Address: 192.36.125.2#53
Aliases:

Host es not found: 5(REFUSED)
; Transfer failed.

peralta@daphne:~ $ host -l es nso.nic.es
; Transfer failed.
Using domain server:
Name: nso.nic.es
Address: 194.69.254.2#53
Aliases:

Host es not found: 9(NOTAUTH)
; Transfer failed.

[...]

peralta@daphne:~ $ host -l es ns.uu.net
; Transfer failed.
Using domain server:
Name: ns.uu.net
Address: 137.39.1.3#53
Aliases:

es name server ns.uu.net.
es name server ns1.nic.es.
ns1.nic.es has address 194.69.254.1
es name server ns1.cesca.es.
ns1.cesca.es has address 84.88.0.3
es name server ns2.nic.es.
ns2.nic.es has address 194.69.254.38
es name server ns3.nic.fr.
es name server nso.nic.es.
es name server sun.rediris.es.
sun.rediris.es has address 130.206.1.2
es name server aunic.aunic.net.
es name server sunic.sunet.se.
natucer.es name server dns1.infc.com.
natucer.es name server dns2.infc.com.
wintu.es name server ns1.servidores.net.
wintu.es name server ns2.servidores.net.

[...]

Sin comentarios ;)