Practical Challenge-Response for DNS