Not ISP-dependent, but DNS-server dependent. The recommendation is also just that: It's not enforced. The TLD can decide to serve those records at the apex if i

Not ISP-dependent, but DNS-server dependent. The recommendation is also just that: It's not enforced. The TLD can decide to serve those records at the apex if it wishes, and any given DNS server should look them up as requested. It just so happens in your case it doesn't -- Windows DNS, for example, will not serve the TLD's A record. Regardless, in your case, `dig pn. +noall +comments`, you'll likely see SERVFAIL. Trying `dig pn. +noall +comments @8.8.8.8` and you'll see that you get a status of NOERROR. (And, of course, `dig pn. +short @8.8.8.8` will give you the correct IP of 139.162.17.173)