DNS is virtually never spoofed in practice because of a combination of (1) sensitive systems being built to assume the DNS was already insecure and (2) the settings where DNS spoofing is useful are already so insecure than DNS security doesn't do much to help you (for instance, coffee shop wireless).

In practice, there are two significant targets for DNS spoofing:

1. SMTP email, where TLS isn't universally required among MTAs.

2. CA domain validation.

For problem (1), we has SMTP STS, which simply establishes a long-term requirement for TLS between a pair of MTAs, sidestepping the spoofing problem.

For problem (2), there is a whole panoply of countermeasures to DNS spoofing, erratically deployed across a variety of CAs. CAs do not as a rule do strict DNSSEC validation (it's too broken), but many of them do multi-perspective lookups which make packet-level spoofing tricky to accomplish in practice.

The real solution to this problem isn't a government-run PKI that forklifts in a whole new DNS protocol, but rather a culling of CAs that can't deploy adequate countermeasures against these attacks.

Note that the Usenix paper illustrates scenarios in which DNSSEC makes this attack easier, not harder.