The RFC acknowledges this problem, which is why it kindly suggests you use DNSSEC ;-) As another commenter mentioned, it all depends on who your attacker is. A

The RFC acknowledges this problem, which is why it kindly suggests you use DNSSEC ;-) As another commenter mentioned, it all depends on who your attacker is. A MITM ssh attack won't necessarily forge your DNS request (maybe your router is compromised?), so even without DNSSEC there might be some use in enabling this.