In terms of a long-term solution to the DNS cache poisoning issue it seems deep packet inspection could be the only way to go. The work-around was to extend the encryption involved with DNS but that only makes it harder, but not impossible for DNS hacks to take place. Only if deep packet inspection happens would DNS hacks truly become a thing of the past, since if my ISP is inspecting all the packets, and it's stored IP for say cnn.com gets re-routed to a hacker's IP, an inspection of the packets coming across could flag a problem to the ISP. I am not an expert in this area but I just recall from reading a 'Wired' article on this issue that the only really good solution here is in fact deep packet inspection. So outlawing it would be a hacker's wet dream, and by hacker I mean "cracker" or "black hat" people obviously.