From the RFC The "_for-sale" leaf node name can be placed at any level of the DNS, except in the .arpa infrastructure TLD.

There used to be a number of sites that would let users create {username}.some.subdomain.apex.tld. Perhaps this is not a thing any more I honestly don't know. If it is still a thing and someone registers the username "_for-sale" they could cause some confusion.

Why allow any level of DNS? If you are selling a domain that should include the entire domain and thus the _for-sale should only be valid at the apex unless the goal is to cause legal problems for some big providers.

▲

wbl 2 hours ago | parent | next [-]

Initial underscore is a reserved namespace for this reason.

▲

Bender an hour ago | parent [-]

Is that universally true on all sites that allow a user to create a sub-domain?

▲

tredre3 10 minutes ago | parent [-]

DNS allows any character you want, including underscores. Host names in URLs cannot contain underscores. Therefore any service that create subdomains for user would reject underscores, which is why they're considered de-facto reserved for special uses in DNS. I don't think the reserved nature is codified in any RFC.

	▲	Bender 4 minutes ago \| parent [-]
		Testing, 1 2 3 [1] Works in Firefox, Helium and Curl but I do not have Chrome to test with. [1] - https://_test.nochan.net/

▲

pimlottc 2 hours ago | parent | prev [-]

Country code TLDs would be one reason. Many countries reserve top-level domains names and only sell second-level domains (e.g. example.co.uk)