DNS: more hardening against crafted responses