What Is DNS, and How Is It Attacked?
DNS (the Domain Name System) translates the names people type into the IP addresses machines use. It is the internet’s phone book — and because almost everything depends on it, and it was designed before security was a priority, it is a rich and recurring target. Control DNS and you can silently send users anywhere while the name in the address bar looks perfectly correct.
How does DNS resolution work?#
Resolving example.com walks a hierarchy:
- Your device asks a resolver (often your ISP’s or a public one).
- The resolver queries a root server, then the top-level domain (
.com) server, then the domain’s authoritative server. - The authoritative server returns the IP address.
- The resolver caches the answer to speed up future lookups.
That caching is convenient — and a target, because a poisoned cache entry serves the wrong answer to everyone using that resolver until it expires.
How is DNS attacked?#
| Attack | Effect |
|---|---|
| DNS spoofing / cache poisoning | Inject false records; redirect users |
| DNS hijacking | Change a domain’s real records at the registrar/resolver |
| Subdomain takeover | Claim a dangling record |
| DNS tunneling | Smuggle data in DNS queries (exfiltration/C2) |
The root problem is that classic DNS answers are unauthenticated — nothing proves a response is genuine, which is exactly what DNSSEC was created to fix.
DNS underpins the whole network. Explore its attacks and defenses from the Network Security hub.
Frequently asked questions#
How does DNS work?
DNS (Domain Name System) translates human-readable names like example.com into IP addresses. When you visit a site, your device queries a resolver, which walks the DNS hierarchy — root, top-level domain, and authoritative servers — to find the answer, caching it along the way for speed. It is effectively the internet’s phone book.
Why is DNS a common attack target?
Because it is foundational and was designed without built-in security. If an attacker can forge or alter DNS responses, they can silently redirect users to malicious servers while the address bar still shows the right name. DNS spoofing, cache poisoning, and hijacking all exploit this trust in unauthenticated answers.