Currently package net's dnsclient gives up on trying to query a DNS server over UDP if it receives a bogus DNS response (e.g., not a DNS packet, mismatched query ID, wrong query name). This makes it a bit more vulnerable to DNS forgery attacks. It would be better if in these cases that dnsclient continued waiting until the deadline for a legitimate response.