Digitally signing and verifying DNS responses to stop such spoofing is done by:

1. Plain DNS answers carry no proof of who sent them. 2. Signatures let a resolver verify the answer is genuine. 3. The extension providing this is DNSSEC. _Source: OpenStax Foundations of Information Systems, Chapter 5, Information Systems Security Risk Management._