Turned out that the DNS responses from OpenDNS (they were in a
cafe somewhere with free wireless that was using OpenDNS) were giving
slightly wrong addresses -- like the real address for example.com was
192.0.2.12, and OpenDNS was giving the response that example.com was at
192.0.2.16 (another server in the same cluster, hence the insane confusion).
No wildcarding or recent DNS changes at our end, either -- it was just
OpenDNS screwing things up *somehow*.
I've never heard of such a report until now. And if true, that would be
shockingly bizarre behavior. In the past when I've heard similar, I
have a 100% success rate in discovering it's actually a misconfiguration
of authoritative records.
