It ocurred to me lately that it might be useful to have a 'honey trap' system that shares the wire with the main DNS systems as a method of monitoring for early warning of possible attacks. Such a system would be run in virtual mode to limit potental damages. In fact running the DNS servers in virtual may also be useful.