pfSense

Something I completely missed with 2.1 but realized the UI doesn't allow yet, it also affect previous 2.0 releases (verified with 2.0.3)

In environments with Active Directory-integrated DNS zones the use of subdomains with leading underscores is quite common.
Every AD environent has a couple of zones like _msdcs.example.net or _sites.example.ne with some SRV required for proper AD operation.

Adding a Domain forwarding via GUI is not possible as it doesn't recognize such a domain name as valid.
While the use of underscore is not be allowed for hostnames (RFC 952), they are not forbidden should be for domain names (so it's not MS circumventing RFCs this time) ;-)

The current workaround I have is to edit config.xml manually, define the forwarded domains and restarting dnsmasq.
Afterwards the GUI doesn't seem to scream but correctly lists them in the UI, so it's more likely to require modification the input validation.