You can limit some of the simple abuses by resolving DNS yourself, but DNSSEC (or other crypo-auth system) is best, of course. I use and recommend doing both,

You can limit some of the simple abuses by resolving DNS yourself, but DNSSEC (or other crypo-auth system) is best, of course. I use and recommend doing both, as there's very little downside to running your own resolver.