I agree with you that the change really has to be an all at once kind of thing. I also know it won't be easy to implement, or else it would have already been done. Perhaps when we make the giant leap to ipv6 the changes can be implemented more widely. The leap to ipv6 is already going to be painful, so perhaps a little extra effort to make DNS and mail more secure will feel like a drop in the bucket.