The idea Geoff presents, of whitelisting the source addresses of the 8000 or so most frequently used recursive nameservers, and giving them priority service, is

The idea Geoff presents, of whitelisting the source addresses of the 8000 or so most frequently used recursive nameservers, and giving them priority service, is a good one, and should help. However, something like 20% of the Internet can still spoof source addresses. That 20% can spoof whitelisted DNS server source addresses, so end up in the priority queue. An interesting question is how many of the bots in these IOT-based botnets are behind home NATs - if it's most of them, then even if their ISP allows spoofing, the IOT device won't be able to spoof. However, it does make it all the more important as IPv6 rolls out that BCP 38 is enforced.