Better than Best Practices are Needed to Defeat DNS Amplification Attacks