In a technical sense, DNS is easy to spoof. It (almost always) uses UDP as the transport protocol, which is trivial to spoof compared to TCP. And DNS itself offers no precautions against spoofing, so if the attacker can return their own packet first, they win. Note that DNSSEC is designed to address this issue and a couple of others.
Successful DNS spoofing, then, relies upon network access. An attacker who has access to the network in a way that allows them to see the client's requests, and spoof response packets, can fool the client into going somewhere other than they intended. Given that fact, you can determine how much of a threat it is. For example, a phishing email generally comes from someone without favored network access, and the threat of the two working together is lower as a result. A malicious user on the same subnet, on the other hand, might be able to gain the level of network access required to perform the spoofing, so that's a more likely danger.
DNS is a low level protocol, and some higher level protocols have protections against this sort of spoofing. For example, an attacker might be able to spoof DNS to redirect a user of https://bigbank.com to their own site, but they'll need a valid SSL certificate to avoid warnings, and if the user actually checks the certificate they'll detect the attack. Similarly, if the attacker spoofs with the goal of redirecting a client's SSH connections, they will get alerts that the host key has changed unless the attacker somehow managed to steal the true SSH server's host key. If they were using Telnet, they'd have no such protection...
To the best of my recollection, the majority of publicized compromises related to DNS were due to DNS poisoning of some sort, and generally not to spoofing. Of course, because poisoning is by it's nature much more public, and spoofing better suited to quiet targeted attacks, we can't assume that means spoofing isn't used. I would hazard a guess, however, that if an attacker has the required network access to spoof, they probably have a handful of other attack vectors which may be more attractive than DNS spoofing. Perhaps that's why we're still not using DNSSEC yet.