RE: I've just tried new.net's plugin. Don't.

[Roeland_M.J_Meyer]

DNS cache poisoning as adequately prevented by making your zone servers
non-recursive.