I have read that the vulnerability is triggered by a DNS response. How can you be vulnerable if you trust your DNS servers?
May your DNS servers redirect your request to other DNS that may be malicious? Is not the DNS who asks those other DNS servers and give you the response? The malicious response may traverse your trusted DNS and exploit you?