Overview: What is DNS Spoofing?
DNS spoofing (also called DNS cache poisoning) occurs when false answers are inserted into a resolver's cache. Clients then receive an incorrect address for a query even though the hostname they typed is unchanged, which shifts traffic at the resolution layer. Review how DNS resolution and caching work.
Understanding the Poisoned Cache
Resolvers cache answers to reduce load. An unauthorized sender may race the legitimate response, matching query parameters such as the transaction ID where weak implementations allow it. If the forged answer is accepted, the resolver serves it until the TTL expires. Flush local DNS cache after suspected mis-resolution.
The Role of DNSSEC
Classic DNS accepts well-formed responses without strong authenticity. DNSSEC adds signatures so a validating resolver can discard answers that fail chain validation for signed zones. Unsigned zones still rely on transport and operational controls. Read how records are published and validated.
Comparison: Spoofing vs. Phishing vs. BGP Hijacking
| Feature | DNS Spoofing | URL Phishing | BGP Hijacking |
|---|---|---|---|
| Browser URL | Technically Correct | Visually Similar (Deceptive) | Technically Correct |
| Primary mechanism | Resolver cache | User-facing deception | Routing and reachability |
| Scope | Resolver or segment | Session / user | Wide-area infrastructure |
Enterprise and Resolver Hardening
Many organizations centralize DNS on internal resolvers, apply response policies, and monitor anomalies. NAC, segmented VLANs, and resolver access lists reduce exposure to untrusted LAN clients publishing answers.
Defense Strategies for Enterprise and Home
- DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT): Transport encryption for stub-to-resolver traffic limits trivial modification on local segments; policy still governs which resolver is trusted.
- Cache hygiene: Periodic flushing of local stub caches removes stale answers after operational incidents.
- Validate TLS certificates: Prefer sites with valid certificates for the hostname; many mis-resolution cases surface as certificate name mismatches or untrusted chains.