Effective defenses against the Kaminsky attack. At risk of over-simplifying, the Kaminsky attack can be used to attack DNS clients that do not use source port randomization. The immediate defense against the Kaminsky attack is to turn on source port randomization. These days, most modern DNS software does perform source port randomization.
(If you haven't done so in a while, I highly recommend that you update your DNS software, on both clients and servers, to get the benefits of this defense.)
The current state. Fortunately, most of the Internet has already upgraded its DNS software to more recent versions that incorporate defenses against the Kaminsky attack. These defenses make the Kaminsky attack quite difficult. (They are not 100% impossible, but they would require a lot of resources: billions of packets.) Therefore, most sites today are likely to be reasonably well protected against the Kaminsky attack. For instance, odds are very good that your ISP and your bank are protected.
If there are any laggards out there who haven't updated their DNS software to a recent version that incorporates defenses against the Kaminsky attack (e.g., source port randomization), then they are likely to be very vulnerable. The Kaminsky attack is quite easy to mount and highly effective, if the server doesn't incorporate defenses against it.
What about DNSSEC? DNSSEC is a separate deal. It is designed to provide security, even in situations where your DNS servers are compromised or where a man-in-the-middle is attacking your network traffic. Therefore, in theory, DNSSEC would provide an acceptable alternative defense against the Kaminsky attack.
However, in practice, relying upon DNSSEC to protect you from the Kaminsky attack would be a lousy idea. There are two problems:
First, DNSSEC is not widely deployed today. Today, very few domains are signed with DNSSEC. This makes it impossible to deploy DNSSEC with strict validation. Instead, in current DNSSEC implementations, if a response for an unsigned domain is received, the response is accepted without performing any cryptographic checks. This means that a client that is vulnerable to the Kaminsky attack can still be attacked, even if it uses DNSSEC.
Second, source port randomization is so easy to deploy, whereas DNSSEC is more challenging (operationally and logistically) to deploy. You'd have to be crazy to continue using old vulnerable versions of DNS software. Deploying source port randomization is easy enough (just upgrade to the latest version of your DNS software, in most cases) that it'd be nuts not to take advantage of the source port randomization defense.
DNSSEC is still a very good idea, and the Kaminsky attack underscores the importance of deploying DNSSEC widely. So, don't misinterpret me. I do encourage you to enable DNSSEC on your machines. Just don't view it as a substitute for source port randomization.
In conclusion. Everyone should be using source port randomization. It's a no-brainer, and it is currently the most effective defense against the Kaminsky attack. Fortunately, my impression is that source port randomization is already very widely used, so most of the Internet should be reasonably well defended against the Kaminsky attack.
Taking a longer view, DNSSEC is important because it provides robust protections against a large class of possible attacks against DNS -- even ones we haven't thought of or aren't aware of, but that might be discovered in the future. It is the best prophylactic we have, to proactively prevent future incidents like the Kaminsky attack. Therefore, it would be best for network operators and others to do what they can to deploy DNSSEC with all deliberate speed.