DNSSEC was already mentioned, but yet another dark corner of DNS are wildcard records.