diff --git a/mdx/incommon/edugain-policy.xml b/mdx/incommon/edugain-policy.xml
index eaf4b0bc..8b7c8f10 100644
--- a/mdx/incommon/edugain-policy.xml
+++ b/mdx/incommon/edugain-policy.xml
@@ -301,6 +301,16 @@
                                 p:regex="" p:message="scope element must not be empty"/>
                             <bean p:id="whiteSpace" parent="inc.RejectStringRegexValidator"
                                 p:regex=".*\s.*" p:message="scope '%s' includes white space"/>
+
+                            <!--
+                                Explicitly accept domains which, although they
+                                fall afoul of the public suffic heuristic, are
+                                nevertheless known to be legitimately used as
+                                security domains.
+                            -->
+                            <bean p:id="mil.no" parent="inc.AcceptStringValueValidator"
+                                p:value="mil.no"/>
+
                             <bean p:id="domainName" parent="inc.AsDomainNameStringValidator"
                                 p:message="scope is not a valid domain name: %s">
                                 <property name="validators">
diff --git a/mdx/uk/edugain-policy.xml b/mdx/uk/edugain-policy.xml
index af68a6e7..893e03af 100644
--- a/mdx/uk/edugain-policy.xml
+++ b/mdx/uk/edugain-policy.xml
@@ -75,6 +75,16 @@
                                 p:regex="" p:message="scope element must not be empty"/>
                             <bean p:id="whiteSpace" parent="inc.RejectStringRegexValidator"
                                 p:regex=".*\s.*" p:message="scope '%s' includes white space"/>
+
+                            <!--
+                                Explicitly accept domains which, although they
+                                fall afoul of the public suffic heuristic, are
+                                nevertheless known to be legitimately used as
+                                security domains.
+                            -->
+                            <bean p:id="mil.no" parent="inc.AcceptStringValueValidator"
+                                p:value="mil.no"/>
+
                             <bean p:id="domainName" parent="inc.AsDomainNameStringValidator"
                                 p:message="scope is not a valid domain name: %s">
                                 <property name="validators">