Nginx resolver vulnerabilities allow cache poisoning attack, by Slava Strebkov

Never configure nginx with the resolver directive pointing to a resolver on the Internet like Google Public DNS, OpenDNS, or your ISP’s resolver.