Hi there,
It seems possible to inject XSS directly on domain records like TXT on the data field. This kind of vulnerability has already been reported on who.is service : https://news.ycombinator.com/item?id=8336025

Edit : it seems that filtering is done after saving changes but not before.