DNS glossary

What is DNS spoofing?

DNS spoofing is a security attack that supplies falsified DNS answers so a domain name resolves to an IP address the attacker chooses. It works by forging responses to a resolver or by altering DNS data in a cache, server or zone, redirecting traffic to malicious destinations.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

DNS spoofing is a security attack that supplies falsified DNS answers to redirect domain names to attacker-controlled IP addresses, either by forging responses or altering cached DNS data. This threat is particularly dangerous for enterprises because a single forged record in a recursive resolver's cache can affect every client using that resolver until the entry expires, enabling credential theft, malware delivery, and traffic interception without requiring changes on client systems. Prevention requires deploying DNSSEC validation, using randomized source ports and query IDs, restricting recursion to trusted clients, and maintaining patched resolver software alongside encrypted transport mechanisms like DNS over TLS.

  • DNS spoofing succeeds by forcing a resolver to accept a forged answer before the legitimate response arrives, with attackers matching the query ID, source port, and question details to bypass validation.
  • A 2008 flaw publicized by Dan Kaminsky demonstrated that weak query ID and source port randomization enabled efficient cache poisoning, prompting vendors to implement source port randomization as a defensive measure.
  • DNSSEC, specified in RFC 4033, RFC 4034, and RFC 4035, adds cryptographic signatures that allow validating resolvers to reject forged data for signed zones, though it provides no protection for unsigned zones.

DNS spoofing at a glance

AttributeValue
CategoryDNS attack technique
Protocol and portTargets DNS, which uses port 53 over UDP and TCP
OSI layerApplication layer
Primary useRedirecting users or systems to attacker-controlled destinations for phishing, malware delivery or traffic interception
Related termsDNS cache poisoning, DNSSEC, DNS hijacking, Recursive resolver, Man-in-the-middle attack

How DNS spoofing works

DNS spoofing succeeds when a resolver or client accepts a forged answer as genuine. The most common form targets a recursive resolver and its cache, so one false answer can affect every client that uses that resolver.

  1. Trigger a query: The attacker causes a target resolver to look up a name, either by querying it directly or by luring a user or application into requesting it.
  2. Forge a response: The attacker sends fake answers that appear to come from the authoritative server. To be accepted, the answer must match details of the pending query, such as the query ID, source port and question.
  3. Win the race: If the forged answer arrives before the real one and matches, the resolver accepts it. Weak randomization of query IDs and source ports makes matching easier.
  4. Cache and serve the false data: The resolver stores the false record for its time to live and returns it to clients, who connect to the attacker's address.

Spoofing can also happen without racing responses, for example by compromising a DNS server, changing zone data, or intercepting traffic on the network path. Validating answers with DNSSEC, randomizing source ports and query IDs, and restricting who can change DNS data reduce the risk.

Why DNS spoofing matters in enterprise networks

DNS underpins nearly every connection an organization makes, so a single forged record can redirect many users at once. Because a recursive resolver caches answers for the record's time to live, one successful spoof can affect every client behind that resolver until the entry expires or is flushed.

The impact is mainly security related. Users may reach a convincing fake login page, applications may download software from a hostile server, and email may be routed to the wrong host. The user often sees the correct domain name, so the attack is hard to notice without validation or monitoring.

A 2008 flaw publicized by researcher Dan Kaminsky showed how weak query ID and source port randomization let attackers poison resolver caches efficiently, and vendors responded with source port randomization. DNSSEC, specified in RFC 4033, RFC 4034 and RFC 4035, adds cryptographic signatures so validating resolvers can reject forged data.

Poorly managed DNS raises exposure. Outdated resolver software, open recursive resolvers, unsigned zones and loosely controlled update permissions all make spoofing easier. Logging resolver responses and watching for unexpected changes in answers helps teams detect it early.

DNS spoofing vs DNS hijacking

DNS spoofing injects forged answers into a resolver, client or cache, while DNS hijacking changes where resolution is directed by altering settings, registrar records or the resolver a client uses. What is DNS hijacking?

AttributeDNS spoofingDNS hijacking
Typical mechanismForged responses or poisoned cache entriesChanged resolver settings, registrar or zone changes, or malware
Point of attackResolver cache, in-flight response or DNS dataClient configuration, router, registrar account or name server delegation
ScopeAll clients of the affected resolver until the entry expiresAffected devices or every user of the hijacked domain, depending on the target
PersistenceUsually limited by the record time to livePersists until the changed setting or record is corrected

DNS spoofing vs DNS sinkhole

DNS spoofing is an attack that returns false answers, while a DNS sinkhole is a defensive control that deliberately returns a controlled answer for known malicious names. What is DNS sinkhole?

Common misconceptions about DNS spoofing

Spoofing can also target recursive resolvers, forwarders and internal caches. A corporate resolver that accepts bad data can affect every client behind it.

TLS with valid certificate checking limits the harm of a redirect, but it does not stop the false DNS answer. Users who click through certificate warnings, or applications that skip validation, remain exposed, and non-web traffic such as email may not be protected.

DNSSEC lets a validating resolver reject forged data for signed zones. It does nothing for unsigned zones, and it protects clients only if the resolver validates and the path between client and resolver is trusted.

Clearing a poisoned cache removes the bad entry but not the cause. If the resolver is still exposed, with predictable query attributes or open recursion, the attacker can poison it again.

The user usually sees the correct name in the address bar. Only the IP address behind it is false, so visual inspection of the domain rarely reveals the attack.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

DNS spoofing FAQ

Related terms

Article

DNS hijacking

DNS hijacking occurs when an attacker changes the IP addresses of a domain's DNS servers to attacker-controlled servers.

Learn more
Article

DNSSEC (Domain Name Service Security Extension)

DNSSEC (Domain Name Service Security Extension) is a mechanism that uses cryptography to authenticate DNS data and verify the integrity of DNS queries and responses.

Learn more
Article

Caching DNS server

A caching DNS server handles recursive requests from clients.

Learn more
Article

Recursive DNS server

A recursive DNS server is the first server contacted by a requesting host; it retrieves the proper IP address of the intended domain name and returns it to the requester.

Learn more
Article

Time to Live (TTL)

TTL (time to live) is a setting for each DNS record that specifies how long a resolver caches the DNS query before it expires.

Learn more
Article

Rogue DNS Server

A rogue DNS server is a DNS server that translates domain names of desirable websites into IP addresses of sites with unintended content.

Learn more
Article

Response Policy Zone (RPZ)

RPZ (Response Policy Zone) is a DNS zone that allows resolvers to rewrite answers to block, redirect, or log queries to risky or disallowed domains, providing administrators real-time security and policy control.

Learn more
Article

DNS over HTTPS (DoH)

DNS over HTTPS (DoH) encrypts DNS queries and responses by transmitting them over HTTPS, protecting DNS traffic from interception and monitoring.

Learn more
Browse the full glossary