DNS poisoning, also known as DNS cache poisoning or DNS spoofing, is a type of cyberattack in which false DNS data is inserted into a resolver’s cache. This malicious data causes users to be unknowingly redirected to fraudulent or compromised websites, even when they type in the correct URL.
The attack targets a foundational assumption of the Domain Name System: that the information returned by a DNS resolver is accurate and trustworthy. By corrupting that trust, attackers can reroute traffic to phishing pages, malware servers, or surveillance infrastructure, often without raising immediate suspicion.
For a deeper technical breakdown of this attack vector and how it has evolved, read our DNS Poisoning blog post.
DNS poisoning occurs during the resolution process, when a recursive DNS resolver queries other servers to resolve a domain name. Attackers exploit weaknesses in DNS caching to insert forged responses into the resolver’s cache.
Once the fake IP address is cached, every user querying that domain through the compromised resolver is redirected to the attacker’s destination—until the cache is manually flushed or the time-to-live (TTL) expires.
Poisoned DNS entries can persist for minutes or hours, depending on cache settings, making the window for exploitation significant. Sophisticated attackers may also chain this with SSL spoofing or TLS stripping to increase the likelihood of successful credential theft or malware delivery.
What is the DNS attack?
DNS poisoning is a form of DNS attack in which corrupted DNS data is used to misdirect users to illegitimate destinations without their knowledge.
DNS poisoning is often invisible to end users, but there are red flags to watch for:
What are two symptoms that indicate DNS spoofing may have occurred?
While the goal remains consistent—corrupt DNS resolution—the techniques used to execute DNS poisoning vary:
Inserting forged responses into a DNS resolver’s cache, tricking it into associating a domain name with a malicious IP address.
Intercepting DNS queries in transit on insecure networks, such as public Wi-Fi, and injecting malicious responses before the legitimate server can reply.
Gaining control of the DNS infrastructure itself by exploiting vulnerabilities in authoritative servers, enabling persistent manipulation of DNS responses for targeted domains.
DNS spoofing is the broader category of attacks in which DNS data is faked to mislead clients. DNS poisoning is a specific type of spoofing focused on corrupting the resolver’s cache.
| Concept | Definition |
| DNS Spoofing |
Any attack where fake DNS responses are used to mislead clients. |
| DNS Poisoning |
A specific spoofing tactic that corrupts a DNS resolver’s cache to persistently misdirect users. |
Example of DNS spoofing:
Redirecting visitors from www.example.com to a visually identical phishing site hosted by an attacker.
Effective prevention requires both protocol-level protections and proactive security strategies. These include:
Protect your users from deceptive redirects, phishing infrastructure, and DNS-level attacks. Start your free trial of DNSFilter and experience proactive DNS security that detects and blocks poisoning attempts before they reach your network.