DNS spoofing and cache poisoning: defending against forged DNS replies

In short: In DNS spoofing a client receives a forged reply and lands on the wrong IP address; DNSSEC, DoT/DoH, random ports and securing the home network protect against it.

In more detail: DNS translates names into IP addresses and was designed without authentication. If an attacker manages to slip in a false reply, bank.example leads to a foreign server (phishing, eavesdropping, malware). This article shows principle and defence.

In Depth

Attack types (principle)

• Cache poisoning: the attacker sends the recursive resolver forged replies until one matches the open query (transaction ID, port); the false entry lands in the cache and affects all users. Famous: Kaminsky attack 2008.
• Local spoofing: in the same network (ARP spoofing, rogue DHCP/Wi-Fi) someone forges replies or supplies a false DNS server.
• Router/hosts manipulation: malware changes hosts or DNS settings; DNS hijacking via a compromised router or registrar account.
• Rogue resolvers, captive portals, typosquatting (similar domains, not spoofing but related).

Protection in the infrastructure

• Random source ports + random transaction IDs (standard today), 0x20 encoding, DNS cookies.
• DNSSEC: records are digitally signed; validating resolvers detect forgeries (SERVFAIL). Domain owners sign their zone.
• Encrypted DNS: DoT (port 853) and DoH (HTTPS) protect client ↔ resolver from eavesdropping/manipulation on the network; but do not replace DNSSEC (resolver trust).
• Keep resolvers current, no open resolvers, rate limiting, clean split horizon.
• Registrar account with MFA, registry lock, CAA records, TLS certificates (even with a wrong IP the browser detects a wrong certificate).

Protection at home and on the device

• HTTPS and HSTS (the browser warns on certificate errors: never click away).
• Router: strong admin password, current firmware, remote access off, check DNS settings (provider or trusted resolver, e.g. with DoT/DoH); WPA2/3 with a good password, guest Wi-Fi for visitors.
• Public Wi-Fi: use a VPN, treat captive portals critically, no banking without HTTPS/VPN.
• Occasionally check the hosts file and DNS settings, antivirus/malware scan.
• Pi-hole/AdGuard Home in the home network with DNSSEC validation.
• Checking: dig +dnssec example.org, dig @1.1.1.1 example.org vs. dig @routerIP example.org (deviations indicate manipulation), DNSSEC test sites.

Classification and learning

• Own labs only: practise cache poisoning in an isolated VM with dnsmasq/BIND (no tests in third-party networks; § 202a-c StGB).
• Classification: DNS problems are often misconfiguration (wrong record, TTL) rather than attack: check dig/nslookup first.
• Signals: certificate warning on a known site, suddenly different login, DNS answer differs per resolver.
• Countermeasure on suspicion: change router/resolver, flush cache (ipconfig /flushdns, resolvectl flush-caches), change passwords.
• Related: DNS records, DNSSEC, ARP, MITM, HTTPS/HSTS, VPN, DHCP.

See also: DNSSEC, DNS records, Pi-hole