DNS Spoofing
An attack that corrupts DNS records to redirect domain name lookups to malicious IP addresses, sending users to fraudulent websites.
DNS spoofing, also known as DNS cache poisoning, is an attack in which corrupt Domain Name System data is injected into a DNS resolver's cache, causing the resolver to return an incorrect IP address for a given domain name. This silently redirects users to attacker-controlled servers when they attempt to visit legitimate websites. Unlike phishing, which relies on deceptive links, DNS spoofing manipulates the fundamental system that translates human-readable domain names into the IP addresses computers use to communicate.
The attack typically targets DNS resolvers — the servers that cache DNS lookup results to improve performance. An attacker floods a resolver with forged DNS responses, attempting to insert a malicious record before the legitimate response arrives. If successful, the poisoned record is cached and served to all users who query that resolver for the affected domain. More targeted variants include compromising DNS server software directly, hijacking DNS registrar accounts to modify authoritative records, or using malware to alter DNS settings on individual devices or routers.
DNS spoofing can have widespread impact. A single poisoned cache entry on an ISP's DNS resolver can redirect millions of users to a fraudulent banking site, e-commerce platform, or software update server. Attackers can harvest credentials, distribute malware, or intercept encrypted communications by combining DNS spoofing with SSL stripping. DNSSEC (Domain Name System Security Extensions) was designed to combat this threat by cryptographically signing DNS records, but adoption remains incomplete. Additional defenses include using encrypted DNS protocols (DNS over HTTPS or DNS over TLS) and monitoring for unexpected DNS changes.
The attack typically targets DNS resolvers — the servers that cache DNS lookup results to improve performance. An attacker floods a resolver with forged DNS responses, attempting to insert a malicious record before the legitimate response arrives. If successful, the poisoned record is cached and served to all users who query that resolver for the affected domain. More targeted variants include compromising DNS server software directly, hijacking DNS registrar accounts to modify authoritative records, or using malware to alter DNS settings on individual devices or routers.
DNS spoofing can have widespread impact. A single poisoned cache entry on an ISP's DNS resolver can redirect millions of users to a fraudulent banking site, e-commerce platform, or software update server. Attackers can harvest credentials, distribute malware, or intercept encrypted communications by combining DNS spoofing with SSL stripping. DNSSEC (Domain Name System Security Extensions) was designed to combat this threat by cryptographically signing DNS records, but adoption remains incomplete. Additional defenses include using encrypted DNS protocols (DNS over HTTPS or DNS over TLS) and monitoring for unexpected DNS changes.
Examples
- An attacker poisons an ISP's DNS cache to redirect all requests for a popular bank's domain to a credential-harvesting site.
- Malware on a home router changes the DNS settings to redirect software update requests to malware distribution servers.
- A compromised DNS registrar account is used to point a company's domain to an attacker-controlled server.
Prevention
- Implement DNSSEC to cryptographically validate DNS responses and prevent cache poisoning.
- Use DNS over HTTPS (DoH) or DNS over TLS (DoT) to encrypt DNS queries and prevent interception.
- Monitor DNS records for unauthorized changes using automated alerting tools.
- Configure DNS resolvers to randomize source ports and query IDs to make spoofing more difficult.