See 'txt cnn.com' The apex is already polluted enough as it is. I suggest to only use use the underscored node name '_security'. (normative reference could be: RFC8552)