Well, I just searched RFCs 1034, 1035, 1101, 1183, 1348, 1876, 1982, 1995, 1996, 2065, 2136, 2181, 2137, 2308, 2535, 2673, 2845, 3425, 3658, 4033, 4034, 4035, 4

Well, I just searched RFCs 1034, 1035, 1101, 1183, 1348, 1876, 1982, 1995, 1996, 2065, 2136, 2181, 2137, 2308, 2535, 2673, 2845, 3425, 3658, 4033, 4034, 4035, 4343, 4592, 5936, 5966, 6604, 7766, 8020, 8482, 8490, and 8767 for the word "hijack", and the only reference I can find is rfc2845 §4.4, and that's referencing using TSIG to prevent man-in-the-middle TCP connection-hijacking of a DNS-over-TCP request. Nothing that I can find there about checking for hijacked DNS. Did you have a specific RFC/section in mind that you were thinking of? (Damn, there are a lot of RFCs devoted to DNS!)