TCP (or UDP) checksums only cover the packet when it is in transit & don't protect the information when it is stored in a device such as a DNS server.