See https://news.ycombinator.com/item?id=44954517 https://news.ycombinator.com/item?id=44954517 They're giving Google Public DNS as example of a failure here.

See https://news.ycombinator.com/item?id=44954517 https://news.ycombinator.com/item?id=44954517 They're giving Google Public DNS as example of a failure here. Whereas what happens in my testing is that it's a cache miss for Google Public DNS, which takes a little over 1 second to look everything up from cold in my part of the world for ~.www.example.com . And in that second they have more than enough time, at LAN speeds (since they are injecting the forged responses from the dnsmasq client machine), to send a tonne of forged DNS/UDP responses which are only around a hundred bytes long each.