When Google Public DNS states that "IP addresses are trivial for attackers to forge," they're referring to a fundamental networking reality: IP packet headers can be arbitrarily modified before transmission. This isn't just theoretical - tools like hping3 make spoofing trivial:

# Example of simple IP spoofing with hping3
hping3 -S -p 80 --flood --rand-source example.com

While spoofing is technically simple, real-world constraints exist:

• Asymmetric Routing: Most ISPs implement ingress filtering (BCP38) preventing spoofed packets from entering their networks
• TCP Handshake Requirements: Spoofed SYN packets won't complete TCP handshakes without control of the spoofed IP

Attackers successfully spoof IPs in these scenarios:

// DNS amplification attack using spoofed source IP
dig @open.resolver.example.com +short test.example.com ANY

UDP-based protocols are particularly vulnerable as they don't require handshakes.

For DNS services specifically:

• Rate limiting per query type
• Response rate limiting (RRL)
• Anycast network distribution

For web applications:

# Nginx realip module configuration
real_ip_header X-Forwarded-For;
set_real_ip_from 192.168.1.0/24;

Modern security requires additional signals:

• Client behavioral analysis
• TLS fingerprinting
• Proof-of-work challenges

Example JavaScript challenge:

// Simple proof-of-work challenge
function generateChallenge() {
  const nonce = Math.random().toString(36).substring(2);
  const difficulty = 4; // Number of leading zeros required
  return { nonce, difficulty };
}

Emerging standards like:

• QUIC protocol's connection migration
• IPv6 Secure Neighbor Discovery (SEND)
• DNSSEC adoption

Example DNSSEC validation:

# Dig command to verify DNSSEC
dig example.com +dnssec +multi

Google's documentation on their public DNS service highlights a sobering fact: IP addresses are trivial to forge in network attacks. While many systems (including Stack Exchange sites) rely on IP-based blocking, attackers can easily spoof source IP addresses when launching DNS amplification or other distributed attacks.

// Example of a raw socket creation allowing IP spoofing (Python)
import socket

s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_UDP)
s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

# Attacker can set any source IP
packet = construct_udp_packet(src_ip="192.168.1.100", dst_ip="8.8.8.8")  
s.sendto(packet, ("8.8.8.8", 53))

The fundamental protocol design of IP doesn't include source verification by default. Three key factors enable IP spoofing:

• No mandatory packet authentication in IPv4
• ISPs rarely implement ingress filtering (BCP 38)
• UDP protocols (like DNS) are stateless

While complete prevention is impossible, these strategies significantly reduce spoofing risks:

// DNS query with randomized TXID and port (important for response validation)
import random
import dns.message

query = dns.message.make_query("example.com", "A")
query.id = random.randint(0, 65535)  # Random transaction ID

Network-Level Protections

• Response Rate Limiting (RRL): Throttle identical responses
• Anycast Routing: Distribute attack traffic across locations
• EDNS Client Subnet: Provides partial client IP information

Application Defenses

// Example: Validate DNS response matches query parameters
def validate_response(query, response):
    if response.id != query.id:
        raise ValueError("TXID mismatch - possible spoofed response")
    if response.question != query.question:
        raise ValueError("Question section altered")

For critical systems, implement additional layers:

• DNSSEC for response validation
• OAuth/IP-based rate limiting combinations
• TCP fallback for large queries

The key insight is that IP-based blocking should only be one component of a layered security strategy, never the sole protection mechanism.