Suppose I define an A record in my DNS for host foo.example.com. If nobody knows about the existence of foo.example.com, but do about example.com, could someone somehow query the DNS records of example.com to return that name foo.example.com?
The answer is it depends. If the user can guess the name, like www, then yes they can. If you use more esoteric names the user would only be able to get arbitrary records if they were able to do what's called a zone transfer, which sends the entire domain's data.
Most nameservers disallow zone transfers by default. You can test yours here:
From end-user perspective of view, no. DNS will only return results for specific Hostname (or IP address for reverse-lookup).
Yet, many DNS servers support the feature known as Zone Transfer, that basically can dump all zone file data to another machine.
By doing so, the server can save some load by letting all other DNS servers have the full zone file instead of delegating the resolve request to it.
In reality, most DNS Administrators will not allow Zone Transfer for obvious (security) reasons.
If you want to try it yourself, use
nslookup (in Windows):
//#requesting for google.com dns server set q=ns google.com #response is: primary name server = ns1.google.com server ns1.google.com ls -d google.com //#this is the zone transfer request
More in Wikipedia