Mine

smtp auth
spf
qmail-queue (to allow for virus scanners)
maildir++ patch
support oversize dns packets (not necessary if you use dnscache)
chkuser (check for local users, envelope syntax) with user extensions enabled (for TMDA)
spam throttle
qregex (regular expression matching in badmailfrom and badmailto)
big concurrency (set the spawn limit above 255)