Like the roof on my house, the DNS has holes. A really bad DNS hole got patched earlier this year – well, mostly patched. I say “patched”, because the solution isn’t very good, it’s just dried up the worst of the problem, but the fix won’t last.
I have bitten the bullet and agreed to have a new roof on my house. Just patching the old one won’t keep the water out any more – it just comes through another place every time it rains. The DNS needs a new roof as well, and it’s called DNSSEC. It will involve lots of Internet folk in real work, but we need to get on with it.