DNS glossary

What is a rogue DNS server?

A rogue DNS server (rogue domain name system server) is an unauthorized resolver that returns false answers to DNS queries. It redirects clients to attacker-chosen IP addresses, usually after a device is pointed at it through malware, a compromised router or a spoofed DHCP response.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

A rogue DNS server is an unauthorized resolver that returns false answers to DNS queries, redirecting clients to attacker-controlled IP addresses through malware, compromised routers, or spoofed DHCP responses. Because DNS sits in front of nearly every network connection and standard DNS lacks response authentication, a single resolver compromise can affect all applications on a device or every device on a network without users noticing. Organizations can detect and prevent rogue DNS servers through DHCP snooping, resolver allow lists, egress filtering of port 53, DNS traffic monitoring, and DNSSEC validation, enabling rapid response to unauthorized resolver queries.

  • Rogue DNS servers redirect clients to attacker-chosen IP addresses by causing devices to query a malicious resolver through malware injection, compromised router settings, or rogue DHCP server distribution of the attacker’s DNS address.
  • Without DNSSEC validation on the client or trusted resolver, plaintext DNS responses cannot be distinguished from forged answers, allowing attackers to persist undetected for extended periods while capturing credentials, delivering malware, or blocking security updates.
  • Detection relies on comparing actual client resolvers against DHCP-assigned settings, scanning for unauthorized DHCP offers, and analyzing firewall or flow logs for port 53 traffic to unexpected destinations.

Rogue DNS server at a glance

AttributeValue
Full nameRogue DNS server
CategorySecurity threat
Protocol and portDNS, typically port 53 over UDP and TCP
OSI layerApplication layer (layer 7)
Primary useRedirecting clients to unintended or malicious destinations by falsifying DNS answers
Related termsDNS hijacking, DNS spoofing, DHCP spoofing, DNSSEC, DNS filtering, recursive resolver

How rogue DNS server works

A rogue DNS server only affects a client that sends queries to it, so the attack centers on getting a device to use the wrong resolver. Once that happens, the server controls the answers the client receives.

  1. Resolver change: The attacker causes a client to use the rogue server. Common methods include malware that edits resolver settings, a compromised home or office router, or a rogue DHCP server that hands out the attacker's DNS address.
  2. Query sent: The client sends a normal DNS query for a name such as a bank or email site to the configured resolver, which is now the rogue server.
  3. Forged answer: The rogue server replies with an IP address it controls instead of the legitimate one. For other names it may forward queries upstream so that most browsing appears normal.
  4. Connection to attacker host: The client connects to the returned address. The attacker can then serve a look-alike page to capture credentials, deliver malware, or inject advertising.

The client usually has no indication that the answer is false, because standard DNS does not authenticate responses. DNSSEC validation can expose forged answers for signed zones, but only if the client or its trusted resolver performs validation.

Why rogue DNS server matters in enterprise networks

Rogue DNS servers matter because DNS sits in front of nearly every network connection. Redirecting a single resolver setting can affect every application on a device, and a compromised router or DHCP scope can affect every device on a network. Users often see no error, so the redirection can persist for long periods before anyone notices.

The security impact includes credential theft through look-alike sites, malware delivery, traffic interception and blocking of security update domains. Because plain DNS responses are unauthenticated, as defined in the original DNS specifications, a client cannot tell a forged answer from a real one unless DNSSEC validation is in place. Encrypted DNS transports protect the path to a chosen resolver but do not help if the resolver itself is the rogue one.

Poor management makes the problem worse. Networks without DHCP snooping, resolver allow lists or egress rules blocking outbound port 53 to unapproved servers give attackers an easy path. Accurate inventories of authorized resolvers, monitoring of DNS traffic destinations and consistent client configuration let teams detect devices that query unexpected servers and respond quickly.

Rogue DNS server vs DNS hijacking

A rogue DNS server is a specific unauthorized resolver that returns false answers, while DNS hijacking is the broader attack category that also covers changing router settings, altering records at a registrar or intercepting queries in transit. What is DNS hijacking?

AttributeRogue DNS serverDNS hijacking
ScopeA single malicious resolverAny technique that redirects DNS resolution
Where the attack happensOn the server the client is pointed atOn the client, the router, the resolver, the registrar or the network path
RelationshipOne common tool used to carry out hijackingThe overall outcome, which can use a rogue server or other means
Typical fixRestore the client resolver setting and remove the rogue server or rogue DHCP sourceDepends on the method used, from resetting a router to securing registrar accounts

Rogue DNS server vs DNS sinkhole

A rogue DNS server is unauthorized and returns false answers to harm users, while a DNS sinkhole is a deliberately deployed resolver that returns controlled answers to block or study malicious domains. What is DNS sinkhole?

AttributeRogue DNS serverDNS sinkhole
AuthorizationUnauthorizedDeployed by the network owner or a defender
PurposeRedirect users to attacker-chosen addressesBlock access to malicious domains or observe infected hosts
Answers returnedFalse addresses pointing at attacker systemsAddresses of a controlled host or a non-routable address

Common rogue DNS server issues

A device on the LAN, such as a consumer router plugged into an office port, answers DHCP requests and hands out its own DNS address. Affected clients show a different resolver in their lease while others on the same VLAN look normal, which makes the problem look intermittent.

A compromised router with a default or weak admin password has its upstream DNS entries replaced. Every device behind it resolves through the attacker, and the change often survives reboots of the clients.

The rogue server answers most names correctly and forges only a few, such as banking or update domains. Routine checks pass, so the issue shows up only as certificate warnings or failed updates on specific sites.

Clients using a rogue resolver cannot resolve internal names or get wrong answers for them. Support tickets report that intranet or directory services fail while public sites still load.

Outbound DNS to arbitrary external servers is allowed, so malware that sets its own resolver goes unseen. Flow data or firewall logs show port 53 traffic to unfamiliar addresses, but nothing alerts on it.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

Rogue DNS server FAQ

Related terms

Article

DNS hijacking

IP addresses of your domain’s DNS servers are changed to IP addresses of attacker-controlled servers.

Learn more
Article

DNS sinkhole

A DNS server that gives out a false result for a domain name.

Learn more
Article

DNS server

Also called a DNS nameserver, it stores DNS records and responds to and resolves DNS queries from devices. Learn More

Learn more
Article

DHCP (Dynamic Host Configuration Protocol)

The standard mechanism to dynamically assign IP addresses within a network.

Learn more
Article

DNSSEC (Domain Name Service Security Extension)

A mechanism that uses cryptography to provide authentication and integrity for DNS queries.

Learn more
Article

Recursive DNS server

Responsible for providing the proper IP address of the intended domain name to the requesting host; the first servers contacted as the result of a request.

Learn more
Article

DNS stub resolver

The part of the client device that facilitates DNS queries.

Learn more
Article

Protective DNS

Protective DNS is an advanced cybersecurity technology that proactively blocks access to malicious domains by analyzing and filtering DNS queries in real-time.

Learn more
Browse the full glossary