DNS spoofing and cache poisoning explained

What DNS spoofing is

DNS spoofing is the forging of DNS answers. Instead of the genuine reply to "what is the address of this name?", the victim receives a fake one pointing to the attacker. If the victim accepts it, their browser, email client or app connects to the wrong server while showing the right name.

Spoofing works because classic DNS was designed without any way to prove an answer is genuine. Queries and replies normally travel over UDP, unencrypted and unsigned, and a resolver or device accepts the first reply that matches the question it asked. The NCSC notes that DNS resolvers can be the target of cyber attacks designed to redirect traffic to incorrect domains, which is why it asks buyers of protective DNS to check providers can prevent spoofing.

DNS cache poisoning

Resolvers cache answers so they do not have to look up the same name again and again. Cache poisoning is the form of spoofing that targets that cache: the attacker gets a forged record stored by a resolver, which then hands it to every user who asks for that name until the record expires.

In the classic attack, the attacker makes a resolver look up a name, then floods it with forged replies that claim to come from the domain's real authoritative server, hoping one arrives first and matches the query. Older resolvers made this easier by using predictable query IDs and a fixed source port. Modern resolvers randomise both, as described in RFC 5452, which makes blind forging far harder, though researchers continue to find new ways to attack caches. That is one reason to use a well-maintained resolver from a trusted provider rather than an old, unpatched server.

DNS spoofing vs DNS cache poisoning

In everyday use, "DNS poisoning" and "DNS spoofing" are often treated as the same thing. Spoofing is the broader term; cache poisoning is the most damaging form. Neither should be confused with DNS hijacking, where the attacker takes control of a router, resolver or domain account rather than forging answers.

Where DNS spoofing happens in practice

Blind cache poisoning of a modern, patched resolver is hard. Most real-world spoofing happens closer to the user, where the attacker can see the lookups:

• Public and guest Wi-Fi, where another device on the same network can watch unencrypted DNS and answer first, or where a malicious hotspot hands out its own DNS server.
• Local networks, where an attacker who has compromised one machine can redirect traffic from others, for example by impersonating the network gateway, and then answer their DNS questions.
• Compromised home and small office routers, which can return forged answers to every device that trusts them; this overlaps with DNS hijacking.
• Old or poorly maintained resolvers, such as forgotten internal DNS servers that have not been patched for years.

The common thread is that plain, unencrypted DNS on an untrusted network is easy to tamper with. Laptops that spend time on home broadband, hotel and café Wi-Fi are the most exposed, which is why sending their lookups securely to a protective resolver matters.

How DNSSEC helps

DNSSEC (DNS Security Extensions) adds digital signatures to DNS records. A resolver that validates DNSSEC can check that an answer for a signed domain really came from that domain's owner and has not been altered. A forged answer fails the check and is rejected, so cache poisoning against signed domains stops working on validating resolvers.

DNSSEC has limits worth understanding:

• It only protects domains whose owners have signed them.
• It only helps if the resolver validates the signatures; the NCSC asks protective DNS buyers to check for DNSSEC support.
• It does not encrypt anything, so lookups can still be read on the network.
• Most devices trust their resolver's verdict, so the path between device and resolver needs protecting separately.

That last point is where encrypted DNS comes in: DNS over TLS or DNS over HTTPS between devices and a trusted, validating resolver stops someone on the local network forging answers. For your own domains, signing with DNSSEC lets validating resolvers worldwide detect forgeries.

How HTTPS limits the damage

Even if an attacker spoofs a DNS answer, HTTPS makes it much harder to exploit quietly. To impersonate a site without warnings, the attacker's server needs a valid certificate for that exact name, which a certificate authority should only issue to someone who controls the domain. Without one, browsers show a certificate warning.

That protection is only as good as people's reactions: anyone who clicks through a warning loses it. Sites that use HTTP Strict Transport Security (HSTS) stop browsers offering that option. Teach staff that a certificate warning on a familiar site is a reason to stop, not to click on; phishing awareness training covers this.

DNS spoofing is also different from email spoofing, where someone sends mail that claims to come from your domain. That is tackled with SPF, DKIM and DMARC, not with DNS resolvers.

How to reduce the risk of DNS spoofing

1. Use a trusted, well-maintained resolver that validates DNSSEC: a protective DNS service or a patched internal resolver that forwards to one.
2. Encrypt DNS between devices and your resolver where the service supports it, or use a roaming client that sends lookups securely; see DNS roaming clients.
3. Keep devices off untrusted DNS. Block outbound DNS that bypasses your resolver and control browser DNS over HTTPS so it uses your provider.
4. Patch internal DNS servers and restrict recursion to your own networks.
5. Sign your own domains with DNSSEC where your DNS host supports it.
6. Use HTTPS everywhere, with HSTS on your own sites, and teach staff to stop at certificate warnings.

How we can help

We can check whether your resolvers validate DNSSEC, whether devices can be pushed onto untrusted DNS, and whether your own domains are signed. If you need a protective DNS service, chosen against the NCSC's guidance for the private sector, we can compare the DNS security solutions we supply. Scope is confirmed at quote; contact us to talk it through.