Don't you think 5 seconds is a bit of a short default?  Personally I'd set this to 30 seconds.  I've seen many instances of DNS results taking longer than 5 seconds in production; particularly if there are any down nameservers in the resolution chain and given that this is predominantly a UDP service too.

Waiting around for 30 seconds in an event driven world is much more acceptable than something like pre-forked Perl where it's holding up a worker etc.

One other thought I had reading this is that if forward_dns is enabled then valid_hostname **MUST** be automatically enabled, otherwise you're going to end up looking up things like 'foo.local' or 'router.dsl' etc. - you can then loose the single label check above.

The other thing I can see here is that if you apply a better timeout, then you can potentially DENYSOFT if you hit it.