I've been running djbdns on all of my servers for several years. I've also been running it on OSX for about three years.
Under 10.4 and earlier, when I specified a custom nameserver, the system would use only the nameserver(s) I specified. However, under 10.5 Apple has apparently changed that behavior, and uses my specified nameservers in addition to the DNS servers specified by the DHCP server. It shows the DHCP-provided server IP on the list, greyed out, so you can't delete it.
For a while, I adopted a "grin and bear it" attitude -- after all, the DHCP server at home is handing out the IP of my internal Linux server (also running djbdns) as the DNS server, so I was only unsafe when I used the laptop outside the house. However, with the recently announced vulnerability in the DNS protocol, the massive world-wide patch effort by major DNS vendors, and the fact that many networks haven't applied the patches yet, I don't really feel safe relying on anybody else's nameservers.
I tried calling Apple about this, but it turns out that my AppleCare contract doesn't cover technical support such as this.
My next approach was to just brute-force search the system for anything relating to DHCP. It took a while, but I was able to find the file which needed to be changed, and figure out the necessary changes. Basically, I found a file which controls which options are used by the DHCP client when handling a response from a DHCP server. I removed the DNS-related options from this list, and after rebooting the system, the laptop now ignores the DNS server options being sent by the DHCP server.
The file I found is named IPConfiguration.xml, and it's buried in this folder: /System » Library » SystemConfiguration » IPConfiguration.bundle » Contents » Resources. You need to create a copy of that file, edit the copy, and remove a few entries in the DHCPRequestedParameterList key. (The entries to remove are those for 6, 15, and 119.) I have added full details on this process to my djbdns setup page, in the section titled Disabling DNS servers from DHCP.
[robg adds: If you're going to use this hint, I strongly suggest using the detailed version of the instructions from the linked blog -- this hint is technical enough that you'll want to make sure you do everything just right, and I didn't want to risk a transcription error.]
Mac OS X Hints
http://hints.macworld.com/article.php?story=20080725172011439