
You're right, spoofing would work... but it wouldn't work because you'd have to spoof the same reply over and over. After about 200 identical replies with different tids (damn the source ip)
Of course if you didn't care *which* domain you cache-poisoned and you just wanted to cache-poison in *general* then you could randomize the domains. That would be tough to block (although hackers *usually* put detectable patterns in their attacks). It would also be undirected an pointless. You'd have to scan to figure out which website you hacked when you were done.
Also, IP spoofing is getting harder.
While I was working at zoneedit, I would call up ISP's every week following packet spoofing attacks (usually easy to detect once you decide to do it) and demand that they block packets with source addresses way out of their range - usually with some success.
But this really should be the default configuration on ALL routers. You should have to work to "unconfigure" source ip filtering, and you should have to know what you're doing.
Simply require routers to verify the source address (I like to call it "RBGP" or reverse-BGP, so people understand it does not require symmetrical routes)
"It might help if we ran the MBA's out of Washington." -- Admiral Grace Hopper