DNS Spoofing and Cache Poisoning: How They Work and What Stops Them

What DNS Spoofing Is

DNS spoofing forges a DNS response so that a resolver caches and serves an attacker-chosen IP address instead of the real one. Once a forged answer is cached, every client using that resolver receives it until the TTL expires — no further attacker action needed.

The Off-Path Problem

An attacker who isn't sitting on the network path between the resolver and the real authoritative server can't simply read or edit the genuine traffic. Instead, the forged response has to be guessed and delivered before the real authoritative answer arrives — a race, not an interception.

What Has to Be Guessed

A resolver identifies a valid reply by a 16-bit transaction ID and the UDP source port the query was sent from. The 2008 Kaminsky attack showed how to turn a low-probability single guess into a practical attack: tricking a resolver into looking up many different, nonexistent subdomains of the same domain gives an attacker many independent races to win the same cache slot, since any one successful forgery poisons the parent domain's records.

The Impact of a Successful Poisoning

Once poisoned, the resolver silently redirects every client that queries it — to a phishing site, an ad-injection point, anything the attacker chose — without touching a single one of the victims' own systems, for as long as the forged record's TTL lasts.

Why DNSSEC Stops This

A validating resolver checks a cryptographic signature chain back to a trusted root before accepting a response. An attacker who successfully wins the guessing race still doesn't hold the zone's private signing key, so the forged response can't produce a valid signature — correct transaction ID and port guesses become irrelevant once validation itself is the thing checking authenticity.

Check DNSSEC for a Domain