DNS cache poisoning (DNS spoofing) is an attack that inserts forged records into a DNS resolver’s cache so that it returns false IP addresses to every user who relies on it.
How DNS cache poisoning works
Recursive resolvers cache answers from authoritative servers to speed up the Domain Name System. Classic DNS runs over UDP and accepts a response if it matches the query’s name, source port and a 16-bit transaction ID. An attacker who can guess these values and answer faster than the real server gets a fake record cached until its TTL expires.
- Kaminsky attack (2008) – Dan Kaminsky showed that by querying random non-existent subdomains, an attacker could retry the race endlessly and poison the delegation for an entire domain within seconds. Vendors released a coordinated fix: source port randomisation.
- SAD DNS (2020) – researchers used a side channel in ICMP rate limiting to infer the randomised port, reviving off-path poisoning.
- On-path attackers in a man-in-the-middle position can forge replies directly.
Why DNS cache poisoning matters
One poisoned resolver at an ISP or company redirects all its users at once – to phishing sites, malware downloads or servers that intercept email. Unlike DNS hijacking, no settings or registrar records are changed, so victims see the correct domain name in the address bar. HTTPS certificate checks still catch many such redirects, but not unencrypted connections or users who ignore warnings.
How to prevent DNS cache poisoning
- Sign zones and enable validation with DNSSEC (RFC 4033–4035), which makes forged records detectable.
- Keep resolver software patched and ensure source port and query ID randomisation.
- Do not run open resolvers; restrict recursion to your own clients.
- Use encrypted DNS (DoH or DoT) to trusted resolvers and enforce HTTPS.
