The message below appeared in a mailing list from a member of my ALS. I don't myself know enough DNS mechanics to verify what the poster said.
He's confused. I can explain in detail if you want, but it's clear that what happened is that www.infonec.ca is set up as an alias for www.infonec.com, and they forgot to renew the .com so NSI pointed it at their expired domain servers until he paid. All the registrars I know would do the same thing. The "suspicious" stuff re authority sections is perfectly normal since the DNS server for infonec.ca is also the server for infonec.com. R's, John PS: The previous claim of NSI hijacking wildcard domains was wrong, too. The only evil I've seen them do recently is AGP frontrunning of domains that people ask about but don't buy.