5 years after major DNS flaw is discovered, few US companies have deployed long-term fix