Subdomains using CNAMEs, what record types are valid

That's exactly the point of a CNAME. A CNAME does not need to point to a DNS in the same zone, it can point to any DNS name registered with any nameserver.

What it means for your clients is an additional DNS lookup on the NS for the other host, but that's a tiny price to pay for the majority of websites on the internet.

TXT records are free-form text records and can be used for things like describing hosts. Can also be used for application specific goals, like DNSBL and SPF. Nowadays, they're widely used to accomplish both these goals.

SRV records are service records and are a kind of extension of MX records and are a little more complex than TXT records. While MX records are used to define which servers will handle the e-mail for a specific domain, giving different weights to different records, SRV records are used to provide things such as the protocol and the port. A SRV record has the following form:

_Service._Proto.Name TTL Class SRV Priority Weight Port Target

Service: the symbolic name of the desired service.

Proto: the transport protocol of the desired service; this is usually either TCP or UDP.

Name: the domain name for which this record is valid.

TTL: standard DNS time to live field.

Class: standard DNS class field (this is always IN).

Priority: the priority of the target host, lower value means more preferred.

Weight: A relative weight for records with the same priority.

Port: the TCP or UDP port on which the service is to be found.

Target: the canonical hostname of the machine providing the service.

One typical example of usage of SRV records is when using the XMPP protocol. For instance, if you have a foobar.com domain, the A record would be used to define the servers where your web contents are and the SRV records would be used to define where your XMPP server is. Typically, they will be located in different addresses.

More info about SRV records here.