DNS Cache Poisoning

How Attackers Use It

Attack Summary

Attacker injects forged DNS responses into a resolver's cache, redirecting a domain to a malicious IP before the legitimate TTL expires.

• Attacker predicts or races resolver query IDs and source ports.
• Forged answer is accepted and cached with malicious mapping.
• Users are redirected to phishing or malware-hosting domains.
• Credentials and sessions are harvested at scale.

Defensive Strategy

Defense Summary

DNSSEC validation. DNS-over-HTTPS/TLS for stub resolvers. Source port randomisation (RFC 5452). Monitor for BGP/DNS anomalies.

• Enable DNSSEC validation end-to-end where possible.
• Use trusted resolvers with DoH/DoT support.
• Harden resolver randomization and cache controls.
• Continuously monitor authoritative DNS and certificate changes.

Detection Signals

• Domain-to-IP mappings changing unexpectedly across regions.
• User reports of valid domains loading suspicious content.
• Resolver logs with abnormal NXDOMAIN and response patterns.

Internal Resources

• Blog
• General Knowledge
• FAQ