A DNSSEC-validating resolver under random subdomain attack against
  a DNSSEC-signed zone can exceed max-cache-size by orders of
  magnitude. Attacker must send queries faster than the resolver
  validates.