What is DNS Spoofing?
Learn what DNS spoofing is, how DNS cache poisoning redirects domains to attacker IPs, and defenses like DNSSEC.
Expected Interview Answer
DNS spoofing (also called DNS cache poisoning) is an attack that injects a forged DNS response into a resolver or client, causing a legitimate domain name to resolve to an attacker-controlled IP address instead of the real one.
When a client asks a DNS resolver to translate a domain name into an IP address, the resolver either has a cached answer or queries upstream servers and caches whatever response it accepts. Because classic DNS queries are sent over unauthenticated UDP with a predictable structure, an attacker who can guess or intercept the query’s transaction ID and source port can race a forged response back to the resolver before the legitimate server replies, poisoning the cache with a malicious IP. Every subsequent client that queries that resolver for the same domain, until the record’s TTL expires, gets redirected to the attacker’s server, commonly used for phishing, credential theft, or malware distribution. This differs from ARP spoofing, which operates on the local Layer 2 segment; DNS spoofing can poison a resolver used by many networks at once. Defenses include DNSSEC, which cryptographically signs DNS records so forged responses fail validation, randomizing query IDs/source ports, and using encrypted DNS (DoH/DoT) to prevent on-path tampering.
- Redirects victims from a legitimate domain to an attacker-controlled server
- Can poison a shared resolver, affecting many clients at once
- Commonly enables phishing, credential theft, or malware delivery
- Mitigated by DNSSEC, randomized query parameters, and encrypted DNS
AI Mentor Explanation
DNS spoofing is like an impostor intercepting a runner sent to fetch 'the address of the away team’s hotel' and handing back a fake address before the real messenger returns. Every subsequent team member who asks the same runner for that hotel address gets sent to the fake location until someone corrects the record. Because nobody verified the first answer against an official source, the wrong destination spreads to everyone who asks.
Step-by-Step Explanation
Step 1
Client queries
A client asks a DNS resolver to translate a domain name into an IP address.
Step 2
Race the real response
The attacker sends a forged response, guessing the transaction ID and port, before the legitimate server replies.
Step 3
Cache poisoned
The resolver accepts and caches the forged mapping if it arrives first and matches expected parameters.
Step 4
Victims redirected
Every client querying that resolver for the domain is sent to the attacker's IP until the TTL expires.
What Interviewer Expects
- Explains the cache-poisoning / forged-response mechanism
- Distinguishes DNS spoofing from ARP spoofing (scope: resolver-wide vs local segment)
- Names concrete defenses: DNSSEC, randomized query IDs/ports, encrypted DNS
- Understands the real-world impact: phishing, credential theft, malware delivery
Common Mistakes
- Confusing DNS spoofing with ARP spoofing
- Thinking HTTPS alone fully prevents DNS spoofing's effects
- Not mentioning DNSSEC as the core cryptographic defense
- Assuming the attack requires local network access, when a resolver can be poisoned remotely
Best Answer (HR Friendly)
“DNS spoofing is when an attacker tricks a DNS server or your device into believing a fake IP address is the correct one for a website, so when you type the site’s name, you actually land on the attacker’s server instead. It is often used for phishing or malware, and it is defended against with DNSSEC, which cryptographically verifies that DNS answers are genuine.”
Code Example
# Query a domain and check if the response is DNSSEC-validated
dig +dnssec example.com
# Look for the AD (Authenticated Data) flag in the response header,
# which indicates the resolver validated the DNSSEC signature
# Compare resolved IP against a trusted resolver to spot mismatches
dig @1.1.1.1 example.com +short
dig @8.8.8.8 example.com +shortFollow-up Questions
- How does DNSSEC prevent DNS spoofing?
- What is the difference between DNS spoofing and DNS hijacking?
- How do DoH and DoT help protect DNS queries from tampering?
- Why does randomizing the query ID and source port make spoofing harder?
MCQ Practice
1. What does DNS spoofing primarily achieve?
DNS spoofing injects a forged response so a domain resolves to the attacker's IP instead of the real one.
2. Which technology is the primary defense against DNS spoofing?
DNSSEC cryptographically signs DNS records so resolvers can reject forged, unsigned responses.
3. How does DNS spoofing differ in scope from ARP spoofing?
A poisoned DNS resolver can misdirect every client that queries it, unlike ARP spoofing which is confined to a local broadcast domain.
Flash Cards
What is DNS spoofing? — Injecting a forged DNS response so a domain resolves to an attacker-controlled IP.
How does the attack typically work? — The attacker races a forged response back before the real DNS server replies, poisoning the cache.
Main defense? — DNSSEC, which cryptographically signs DNS records to detect forgeries.
DNS spoofing vs ARP spoofing scope? — DNS spoofing can affect a whole resolver's clients; ARP spoofing is confined to one local segment.