Re: djbdns/dnscache poisoning weakness

Some time ago I implemented a change to dnscache to deal  with a slow,
congested  connection to the Internet.  Queries were being pushed off the
list before a reply could get through so I added a time check to the
queries.  Queries must have a minimum age before they are dropped if they
are not old enough new queries are dropped instead.  This helps prevents DOS
attacks and reduces the threat of poisoning.  How much it is reduced is not
obvious but since a real reply can now always get through it is significant.

The code was quite simple if anyone is interested.