Also, throw in all misconfigurations related to DNSSEC and you are in hell.