DNSSEC prevents that if set up properly.