DNS Spoofing and Cache Poisoning
DNS spoofing feeds a resolver forged answers so that users looking up a legitimate domain are sent to an attacker’s server instead. Its most impactful form, cache poisoning, plants a false record in a shared resolver’s cache — silently redirecting everyone who uses it, while the name in the address bar stays exactly right. It is a direct assault on the trust DNS places in unauthenticated answers.
How does cache poisoning work?#
Classic DNS answers are unauthenticated and were historically easy to forge:
- The attacker triggers or awaits a resolver’s query for a target domain.
- They race to send a forged response that looks legitimate — right query ID, right question.
- If theirs arrives first and matches, the resolver caches the false IP.
- Every subsequent user of that resolver is directed to the attacker’s server.
Because the poisoned entry lives in a shared cache, one successful forgery can affect many users — the amplification that makes this a serious man-in-the-middle enabler.
How is it defended?#
| Defense | Effect |
|---|---|
| DNSSEC | Signs records; forged answers fail verification |
| Source-port + query-ID randomization | Makes blind forgery far harder |
| DNS over HTTPS/TLS | Encrypts and integrity-protects the query path |
| Resolver hardening | Limits cache-poisoning windows |
DNSSEC is the structural fix: by authenticating records, it makes forged answers detectable rather than trusted.
DNS spoofing is a foundational network attack. More at the Network Security hub.
Frequently asked questions#
What is DNS cache poisoning?
DNS cache poisoning is an attack that inserts a forged record into a DNS resolver’s cache, so it returns an attacker-chosen IP address for a domain. Every user of that resolver is then silently redirected to the malicious server until the poisoned entry expires. The address bar still shows the legitimate name.
How does DNSSEC help against spoofing?
DNSSEC cryptographically signs DNS records, so a resolver can verify that an answer genuinely came from the authoritative source and was not altered. A forged record fails the signature check and is rejected. It does not encrypt DNS, but it authenticates it — closing the door on spoofing and poisoning.