What is DNS Spoofing and How to Protect Against It

What Is DNS and Why Does It Matter?

The Domain Name System (DNS) is the internet's phone book. When you type a website address like example.com into your browser, your computer does not know where to find that website. It needs to translate the human-readable domain name into an IP address -- the numerical address that identifies the server hosting the website.

This translation process happens through DNS queries. Your computer asks a DNS resolver, "What is the IP address for example.com?" The resolver checks its cache, queries authoritative DNS servers if needed, and returns the answer. This happens in milliseconds, dozens or hundreds of times a day, completely behind the scenes.

DNS is fundamental to how the internet works. It is also a prime target for attackers because if they can control the answers to DNS queries, they can redirect you anywhere they want.

How DNS Spoofing Works

DNS spoofing, also called DNS cache poisoning, is an attack where false DNS records are introduced into a DNS resolver's cache. When the resolver has a poisoned cache entry, it returns the wrong IP address for a domain, sending users to an attacker-controlled server instead of the legitimate one.

Cache Poisoning

The classic DNS spoofing attack targets DNS resolvers -- the servers that handle DNS queries for networks. Here is how it works:

The attacker sends a flood of forged DNS responses to a resolver, each claiming to be the authoritative answer for a popular domain.
These forged responses contain the attacker's IP address instead of the real one.
If a forged response arrives at the right moment with the right parameters (matching the resolver's query ID and port), the resolver accepts it as legitimate.
The poisoned entry is cached, meaning every user who queries that resolver for the same domain will be directed to the attacker's server until the cache entry expires.

Local DNS Hijacking

Malware on your computer can modify your local DNS settings or the system's hosts file to redirect specific domains. This is simpler than cache poisoning because it only affects one device, but it can be equally dangerous for the individual victim.

Router DNS Hijacking

If an attacker compromises your home or office router (often through default passwords or known vulnerabilities), they can change the DNS server settings. Every device on the network then uses the attacker's DNS server, which can return false results for any domain.

Rogue DNS Servers

On public WiFi networks, an attacker running a rogue access point can configure it to use their own DNS server. All devices that connect to the rogue network will use the attacker's DNS, which can redirect any domain to any IP address.

The Impact of DNS Spoofing

When DNS spoofing succeeds, the attacker can:

Redirect you to phishing pages. You type your bank's URL into your browser, but DNS sends you to a perfect replica controlled by the attacker. Your browser shows the correct URL in the address bar, making the deception even more convincing. This is particularly effective for credential harvesting.
Intercept your communications. The attacker's server can act as a proxy, forwarding your traffic to the real server while capturing everything that passes through -- a form of man-in-the-middle attack.
Distribute malware. Legitimate software update domains can be redirected to servers hosting malicious payloads. Your computer thinks it is downloading a genuine update but is actually installing malware.
Censor content. DNS spoofing can be used to block access to specific websites by returning invalid addresses, effectively making those sites unreachable.
Redirect email. By spoofing the DNS records for mail servers (MX records), an attacker can redirect email destined for your domain to their own servers.

How DNSSEC Protects Against DNS Spoofing

DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records. When a DNS resolver receives a response for a DNSSEC-protected domain, it can verify the signature to confirm that the response came from an authoritative source and was not modified in transit.

Here is how DNSSEC works:

The domain owner signs their DNS records with a private key.
The public key is published in the DNS, chained up to the root DNS servers through a "chain of trust."
When a resolver receives a signed DNS response, it validates the signature using the published public key.
If the signature does not match -- indicating the response was forged or tampered with -- the resolver rejects it.

DNSSEC is effective but not universally deployed. Both the domain owner and the resolver must support DNSSEC for the protection to work. If you manage a domain, enabling DNSSEC through your domain registrar is one of the most impactful steps you can take.

Secure DNS Providers

Using a secure, trustworthy DNS resolver is essential. Many ISP-provided DNS resolvers lack modern security features. Consider switching to one of these alternatives:

Cloudflare DNS (1.1.1.1)

Supports DNS over HTTPS (DoH) and DNS over TLS (DoT)
Does not log your IP address
DNSSEC validation enabled by default
Fast response times globally

Google Public DNS (8.8.8.8)

Supports DoH and DoT
DNSSEC validation enabled
Extensive global infrastructure

Quad9 (9.9.9.9)

Blocks known malicious domains automatically
Supports DoH and DoT
DNSSEC validation enabled
Non-profit, privacy-focused

DNS over HTTPS and DNS over TLS

Traditional DNS queries are sent in plain text, making them visible to anyone monitoring your network traffic and vulnerable to interception. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt your DNS queries, preventing eavesdropping and tampering.

DoH sends DNS queries over HTTPS, blending them with regular web traffic. Most modern browsers support DoH and can be configured to use it.
DoT uses a dedicated encrypted channel for DNS queries. It is typically configured at the operating system or router level.

Both protocols prevent attackers on your local network from seeing or modifying your DNS queries, which is particularly important on public WiFi.

How to Verify Your DNS Is Not Compromised

Take these steps to check whether your DNS settings have been tampered with:

Check your DNS settings. On your computer and router, verify that the DNS servers are set to known, legitimate providers. If you see unfamiliar DNS server addresses, they may have been changed by malware or an attacker.
Use DNS leak tests. Online tools like dnsleaktest.com show you which DNS servers your device is actually using. If the results show unexpected servers, investigate further.
Compare DNS results. Use the nslookup or dig command to query different DNS servers for the same domain. If you get different IP addresses from different resolvers, one of them may be returning poisoned results.
Monitor for certificate warnings. If DNS spoofing redirects you to a fake server, the SSL certificate will not match the domain. Browser certificate warnings in this context are a serious red flag.
Check your router. Log into your router's admin interface and verify the DNS settings. While you are there, change the default password if you have not already.

Protecting Your Domain Against DNS Attacks

If you own a domain, you have a responsibility to protect the DNS records that your visitors rely on:

Enable DNSSEC through your domain registrar to sign your DNS records
Use a reputable DNS hosting provider with DDoS protection and redundant infrastructure
Enable two-factor authentication on your domain registrar and DNS management accounts
Monitor DNS changes with alerting tools that notify you if your records are modified unexpectedly
Use long TTL values cautiously -- while longer TTLs reduce query load, they also mean poisoned cache entries persist longer

A Foundation of Trust

DNS is the foundation of internet navigation. When DNS is compromised, even the most security-conscious user can be deceived because the attack happens at a level below what is visible in the browser. By using secure DNS providers, enabling encryption for your DNS queries, and implementing DNSSEC for your domains, you can build a more trustworthy foundation for all your online activities.