DNS records tend to hang around in caches, and people query the same RRs regularly. Thus, it's pretty hard to spoof a RR that you're regularly requesting. This

DNS records tend to hang around in caches, and people query the same RRs regularly. Thus, it's pretty hard to spoof a RR that you're regularly requesting. This doesn't help for those zones that are not DNSSEC enabled, but there's nothing you can really do about that. If a zone is DNSSEC signed and I query its records regularly(i.e. they stay in the cache) it would be very hard to spoof their records. If I also use a recursive resolver that does DNSSEC validation(e.g., 8.8.8.8) it's even harder. I'm not quite willing to say it would be impossible, but AFAIK no one has shown it to be possible.