Pretty close. Step 1 isn't quite right - you can't make your resolver send queries repetitively as it will just use its cache. The attack involves sending to

Pretty close. Step 1 isn't quite right - you can't make your resolver send queries repetitively as it will just use its cache. The attack involves sending tons of queries to the auth server yourself(or, from a botnet) - but spoofing to appear that you are the resolver you are poisoning. The auth server starts dropping queries from this ip, allowing you to send it answers with greater chance of successful poisoning.