DNS glossary

What is a rogue DNS server?

A rogue DNS server (rogue domain name system server) is an unauthorized resolver that returns false answers to DNS queries. It redirects clients to attacker-chosen IP addresses, usually after a device is pointed at it through malware, a compromised router or a spoofed DHCP response.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

A rogue DNS server is an unauthorized resolver that returns false answers to DNS queries, redirecting clients to attacker-controlled IP addresses through malware, compromised routers, or spoofed DHCP responses. Because DNS sits in front of nearly every network connection and standard DNS lacks response authentication, a single resolver compromise can affect all applications on a device or every device on a network without users noticing. Organizations can detect and prevent rogue DNS servers through DHCP snooping, resolver allow lists, egress filtering of port 53, DNS traffic monitoring, and DNSSEC validation, enabling rapid response to unauthorized resolver queries.

  • Rogue DNS servers redirect clients to attacker-chosen IP addresses by causing devices to query a malicious resolver through malware injection, compromised router settings, or rogue DHCP server distribution of the attacker’s DNS address.
  • Without DNSSEC validation on the client or trusted resolver, plaintext DNS responses cannot be distinguished from forged answers, allowing attackers to persist undetected for extended periods while capturing credentials, delivering malware, or blocking security updates.
  • Detection relies on comparing actual client resolvers against DHCP-assigned settings, scanning for unauthorized DHCP offers, and analyzing firewall or flow logs for port 53 traffic to unexpected destinations.

Rogue DNS server at a glance

AttributeValue
Full nameRogue DNS server
CategorySecurity threat
Protocol and portDNS, typically port 53 over UDP and TCP
OSI layerApplication layer (layer 7)
Primary useRedirecting clients to unintended or malicious destinations by falsifying DNS answers
Related termsDNS hijacking, DNS spoofing, DHCP spoofing, DNSSEC, DNS filtering, recursive resolver

How rogue DNS server works

A rogue DNS server only affects a client that sends queries to it, so the attack centers on getting a device to use the wrong resolver. Once that happens, the server controls the answers the client receives.

  1. Resolver change: The attacker causes a client to use the rogue server. Common methods include malware that edits resolver settings, a compromised home or office router, or a rogue DHCP server that hands out the attacker's DNS address.
  2. Query sent: The client sends a normal DNS query for a name such as a bank or email site to the configured resolver, which is now the rogue server.
  3. Forged answer: The rogue server replies with an IP address it controls instead of the legitimate one. For other names it may forward queries upstream so that most browsing appears normal.
  4. Connection to attacker host: The client connects to the returned address. The attacker can then serve a look-alike page to capture credentials, deliver malware, or inject advertising.

The client usually has no indication that the answer is false, because standard DNS does not authenticate responses. DNSSEC validation can expose forged answers for signed zones, but only if the client or its trusted resolver performs validation.

Why rogue DNS server matters in enterprise networks

Rogue DNS servers matter because DNS sits in front of nearly every network connection. Redirecting a single resolver setting can affect every application on a device, and a compromised router or DHCP scope can affect every device on a network. Users often see no error, so the redirection can persist for long periods before anyone notices.

The security impact includes credential theft through look-alike sites, malware delivery, traffic interception and blocking of security update domains. Because plain DNS responses are unauthenticated, as defined in the original DNS specifications, a client cannot tell a forged answer from a real one unless DNSSEC validation is in place. Encrypted DNS transports protect the path to a chosen resolver but do not help if the resolver itself is the rogue one.

Poor management makes the problem worse. Networks without DHCP snooping, resolver allow lists or egress rules blocking outbound port 53 to unapproved servers give attackers an easy path. Accurate inventories of authorized resolvers, monitoring of DNS traffic destinations and consistent client configuration let teams detect devices that query unexpected servers and respond quickly.

Rogue DNS server vs DNS hijacking

A rogue DNS server is a specific unauthorized resolver that returns false answers, while DNS hijacking is the broader attack category that also covers changing router settings, altering records at a registrar or intercepting queries in transit. What is DNS hijacking?

AttributeRogue DNS serverDNS hijacking
ScopeA single malicious resolverAny technique that redirects DNS resolution
Where the attack happensOn the server the client is pointed atOn the client, the router, the resolver, the registrar or the network path
RelationshipOne common tool used to carry out hijackingThe overall outcome, which can use a rogue server or other means
Typical fixRestore the client resolver setting and remove the rogue server or rogue DHCP sourceDepends on the method used, from resetting a router to securing registrar accounts

Rogue DNS server vs DNS sinkhole

A rogue DNS server is unauthorized and returns false answers to harm users, while a DNS sinkhole is a deliberately deployed resolver that returns controlled answers to block or study malicious domains. What is DNS sinkhole?

AttributeRogue DNS serverDNS sinkhole
AuthorizationUnauthorizedDeployed by the network owner or a defender
PurposeRedirect users to attacker-chosen addressesBlock access to malicious domains or observe infected hosts
Answers returnedFalse addresses pointing at attacker systemsAddresses of a controlled host or a non-routable address

Common rogue DNS server issues

A device on the LAN, such as a consumer router plugged into an office port, answers DHCP requests and hands out its own DNS address. Affected clients show a different resolver in their lease while others on the same VLAN look normal, which makes the problem look intermittent.

A compromised router with a default or weak admin password has its upstream DNS entries replaced. Every device behind it resolves through the attacker, and the change often survives reboots of the clients.

The rogue server answers most names correctly and forges only a few, such as banking or update domains. Routine checks pass, so the issue shows up only as certificate warnings or failed updates on specific sites.

Clients using a rogue resolver cannot resolve internal names or get wrong answers for them. Support tickets report that intranet or directory services fail while public sites still load.

Outbound DNS to arbitrary external servers is allowed, so malware that sets its own resolver goes unseen. Flow data or firewall logs show port 53 traffic to unfamiliar addresses, but nothing alerts on it.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

Rogue DNS server FAQ

Related terms

Article

DNS hijacking

DNS hijacking occurs when an attacker changes the IP addresses of a domain's DNS servers to attacker-controlled servers.

Learn more
Article

DNS sinkhole

A DNS sinkhole is a DNS server configured to return a false IP address for a domain name to block access to that domain.

Learn more
Article

DNS server

A DNS server stores DNS records and responds to DNS queries from devices, resolving domain names to IP addresses.

Learn more
Article

DHCP (Dynamic Host Configuration Protocol)

DHCP (Dynamic Host Configuration Protocol) is the standard mechanism to dynamically assign IP addresses within a network.

Learn more
Article

DNSSEC (Domain Name Service Security Extension)

DNSSEC (Domain Name Service Security Extension) is a mechanism that uses cryptography to authenticate DNS data and verify the integrity of DNS queries and responses.

Learn more
Article

Recursive DNS server

A recursive DNS server is the first server contacted by a requesting host; it retrieves the proper IP address of the intended domain name and returns it to the requester.

Learn more
Article

DNS stub resolver

A DNS stub resolver is the component on a client device that initiates and facilitates DNS queries to recursive resolvers.

Learn more
Article

Protective DNS

Protective DNS is a cybersecurity technology that proactively blocks access to malicious domains by analyzing and filtering DNS queries in real-time.

Learn more
Browse the full glossary