DNS Cache Poisoning
DNS cache poisoning (also called DNS spoofing) is an attack where a malicious actor injects forged DNS responses into a resolver's cache, redirecting users to attacker-controlled servers. This can lead to phishing attacks, credential theft, and malware distribution. DNSSEC was designed specifically to prevent this attack by adding cryptographic authentication to DNS responses.
Symptoms
- Users redirected to phishing pages instead of the real website
- DNS queries returning unexpected IP addresses
- SSL certificate warnings when visiting a familiar domain
- Reports of credential theft despite secure server configuration
Common Causes
- Lack of DNSSEC on the domain
- Resolver using predictable source ports for DNS queries
- Man-in-the-middle attacks on unencrypted DNS traffic
- Compromised upstream DNS resolver
- Open recursive resolvers accessible from the internet
Step-by-Step Troubleshooting
- 1
Verify DNS responses
Compare DNS responses from multiple resolvers to detect inconsistencies.
Use DNS Lookup → - 2
Check DNSSEC status
Verify if DNSSEC is enabled and properly configured to prevent spoofing.
Use DNSSEC Check → - 3
- 4
Enable DNSSEC
Deploy DNSSEC signing on your authoritative nameserver and publish DS records at your registrar.
- 5
Use encrypted DNS
Configure DNS over HTTPS (DoH) or DNS over TLS (DoT) on your resolvers to prevent man-in-the-middle attacks.
Recommended Diagnostic Tools
Monitor DNS Integrity
Detect unauthorized DNS record changes instantly.