Fundamentally, I think this is an issue with DNS itself. It assumes trust, it assumes central control, and it assumes nobody is trying to screw with you on a higher level. In the long run it'll probably need to be replaced with something that works more like public keys.