Cybersecurity glossary
What is DNS Spoofing / Cache Poisoning?
Learn what DNS spoofing and DNS cache poisoning are, how forged answers redirect users to malicious hosts, and how DNSSEC, resolver hygiene, and monitoring reduce the risk.
Definition
DNS spoofing and cache poisoning are attacks that inject forged Domain Name System answers so resolvers or clients cache incorrect mappings from names to addresses, steering traffic toward attacker-controlled infrastructure.
Why DNS spoofing matters
DNS converts names people trust into IP addresses machines contact. If that mapping is forged, everything above it can be misdirected: websites, APIs, mail routing, and software update endpoints.
DNS spoofing injects false answers. Cache poisoning is the high-leverage form where a recursive resolver stores the lie and multiplies it across users. The attacker may not need to break TLS on day one; they need the wrong address to be believed long enough to achieve phishing, malware distribution, or interception of unprotected protocols.
How cache poisoning works
Classic poisoning races or injects responses that a resolver will accept for a pending query.
Trigger or wait for a lookup
The attacker needs the target resolver to query for a name they can influence.
Forge answers toward the resolver
Spoofed UDP responses attempt to match transaction parameters the resolver expects.
Win acceptance
If validation is weak, the forged record is accepted as authentic DNS data.
Cache the false mapping
The resolver stores the attacker IP for the poisoned name according to TTL.
Victims receive bad answers
Users and systems relying on that resolver are steered to malicious infrastructure.
Pursue objectives
Credential harvesting, malware delivery, or traffic interception follows.
On-path attackers on local networks can also spoof DNS more directly without winning a wide Internet race, especially on open Wi-Fi or compromised gateways.
Spoofing vs related DNS threats
| Threat | Mechanism |
|---|---|
| DNS spoofing / poisoning | False answers accepted and often cached |
| DNS rebinding | Attacker-owned domain changes answers over time to hit internal IPs |
| Domain hijacking | Registrar/account takeover changes legitimate authoritative data |
| DNS tunneling | Abuse of DNS queries/responses as a covert data channel |
Defenses that raise integrity
DNSSEC signing and validation
Sign authoritative zones and validate at resolvers so forged records fail cryptographic checks.
Hardened resolvers
Use modern resolvers with source-port randomization, query protections, and secure defaults.
Encrypted DNS where appropriate
DoT/DoH can reduce on-path tampering between stub and chosen resolver, with trust-model tradeoffs.
TLS authenticity
HTTPS certificate checks limit silent web spoofing even when DNS is wrong—if users heed warnings.
Operational checklist
- Deploy DNSSEC for critical public zones and enable validation on enterprise resolvers.
- Disable or tightly control open recursive resolvers that amplify poisoning and abuse.
- Monitor name-to-address changes for payment, SSO, and software-update domains.
- Protect registrar and DNS control-plane accounts with phishing-resistant MFA.
- Prefer multiple resolution vantage points when investigating suspected poisoning.
- Patch and configure recursive software according to vendor DNS security guidance.
- Combine DNS integrity controls with certificate transparency monitoring for web properties.
- Document cache-flush and incident steps before a poisoning event occurs.
The practical takeaway
DNS spoofing / cache poisoning replaces truthful name resolution with attacker-chosen answers. Cached lies spread quickly and undermine trust in every application that believes DNS.
Authenticate DNS data with DNSSEC, harden resolvers, protect control planes, and keep transport authentication (TLS) strong. Name resolution is part of your security boundary—not merely a networking convenience.
Related security terms
DNSSEC (Domain Name System Security Extensions)
Cryptographic authentication of DNS data that helps detect forged answers.
Domain Name System (DNS)
The resolution system whose integrity spoofing attacks undermine.
Man-in-the-Middle (MITM)
Network position often used to inject or observe poisoned resolution paths.
HTTPS
TLS authentication can reduce impact when users land on the wrong IP without a valid certificate.
Frequently asked questions
What is DNS spoofing in simple terms?
DNS spoofing feeds a computer or resolver the wrong answer for a domain name so traffic goes to an IP the attacker chooses instead of the real site.
What is DNS cache poisoning?
Cache poisoning is spoofing that causes a resolver to store the forged answer and serve it to many users until the TTL expires or the cache is flushed.
How does DNSSEC help?
DNSSEC lets validating resolvers verify cryptographic signatures over DNS data. Forged records without valid signatures can be rejected.
Does HTTPS make DNS spoofing harmless?
HTTPS helps because browsers check certificates for the name the user requested. Spoofing still enables outages, interception of non-TLS services, and phishing if users ignore certificate warnings.
What was the Kaminsky vulnerability?
A widely discussed 2008-class cache poisoning technique that showed practical ways to inject forged records into vulnerable resolvers at scale, accelerating DNS security improvements.
Who should deploy DNSSEC—authoritative or recursive?
Domain owners sign zones at authoritative servers. Recursors should validate. Both sides matter for end-to-end benefit.
How can organizations detect poisoning?
Monitor resolution consistency from multiple vantage points, alert on unexpected address changes, enable DNSSEC validation logging, and track sudden traffic shifts to unfamiliar destinations.
References
Explore authoritative guidance and frameworks related to dns spoofing / cache poisoning.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.