DNS Poisoning & Injection

Forcing DNS to store fake data

Introduction

DNS Cache Poisoning, also known as DNS Spoofing, is an attack in which an attacker causes a DNS resolver or DNS cache to store incorrect DNS information.

DNS normally translates human-readable domain names such as:

If an attacker successfully poisons a DNS cache, the resolver may instead return an attacker-controlled IP address rather than the legitimate one.

The victim can therefore enter the correct website address but be silently redirected somewhere malicious.

How DNS Cache Poisoning Works

A typical DNS process works like this:

  1. USER REQUEST
    The user requests www.example.com by typing it into their browser, or clicking a link
  2. DNS QUERY
    The user’s device sends the DNS query to its configured DNS resolver for the IP address
  3. DNS RESOLUTION
    If the resolver does not have the answer already cached, it queries an authoritative DNS server for the answer
  4. DNS RESPONSE
    The legitimate IP address is returned to the resolver
  5. CACHE
    The resolver temporarily stores the result in its cache according to the DNS TTL (Time-To-Live)
  6. USER CONNECTS
    The user is directed to the legitimate server.

With DNS cache poisoning, the attacker attempts to introduce a false DNS response into this process.

The poisoned result can then be cached and returned to other users.

The important concept here is that the victim may never interact directly with the attacker during the initial poisoning process.

The compromised DNS resolver effectively becomes the mechanism that redirects subsequent users.

By poisoning the DNS cache and then controlling where victims get redirected, The attacker could use a fake website to attempt:

  • Credential harvesting
  • Session theft
  • Malware delivery
  • Financial fraud
  • Collection of sensitive information

What Can DNS Cache Poisoning Affect?

  • Websites – Users can be redirected to fraudulent websites.
  • Authentication – Fake login pages can attempt to capture credentials.
  • Email – Mail-related DNS manipulation can potentially redirect communications.
  • Software Updates – Users may be directed toward malicious infrastructure if update-related DNS resolution is compromised.
  • Internal Services – Poorly protected internal DNS infrastructure can potentially be abused to redirect users toward malicious systems.
  • Security Infrastructure – DNS manipulation can interfere with access to legitimate security or monitoring services.

DNS Cache Poisoning vs DNS Spoofing

Although these two terms are often used interchangeably, there is an important distinction between them

When DNS Spoofing is performed, the attacker provides a false DNS response to a DNS query and typically only affects one user.

Whereas with DNS Cache Poisoning, the false information is stored in a DNS cache, causing subsequent queries to receive the malicious result.

DNS Cache poisoning can have a much broader impact because the fraudulent information may affect multiple users relying on the same resolver.

Detection Indicators

Security teams should investigate:

  • Unexpected changes to DNS records
  • DNS responses containing unusual IP addresses
  • Users being redirected to unexpected infrastructure
  • DNS records with unusually long or suspicious TTL values
  • DNS queries returning different answers from different resolvers
  • Unexpected DNS server configuration changes
  • Sudden increases in DNS traffic
  • DNS responses originating from unexpected sources
  • Certificates that do not match the expected service
  • Users reporting unexpected website redirects

Comparing DNS responses from multiple trusted resolvers can also help identify inconsistencies.

Prevention and Defence

Organisations should implement multiple layers of protection against DNS attacks like this.

  • DNSSEC – DNS Security Extensions (DNSSEC) use cryptographic signatures to help validate that DNS responses originate from an authorised source and have not been modified.
  • Secure DNS Resolvers – Use reputable, properly configured DNS infrastructure and keep resolver software patched.
  • Randomisation – Modern DNS resolvers use techniques such as transaction-ID and source-port randomisation to make forged responses significantly harder to successfully inject.
  • Network Monitoring – Monitor DNS traffic for unusual responses, unexpected destinations and abnormal query patterns.
  • DNS Logging – Maintain sufficient DNS logging to investigate suspicious resolution activity.
  • HTTPS / TLS – HTTPS does not prevent DNS poisoning, but certificate validation can expose attempts to impersonate legitimate HTTPS services.
  • Least Privilege – Restrict administrative access to DNS infrastructure and protect DNS management systems.

Conclusion

DNS cache poisoning attacks the trust placed in DNS resolution – Rather than attacking the website itself, an attacker attempts to manipulate the mechanism that tells users where that website is located.

For defenders, DNS should be treated as an important security control rather than simply a networking service.

Secure DNS infrastructure + DNSSEC + monitoring + HTTPS + strong administrative controls provide multiple layers of defence against DNS manipulation.