What is DNS Cache Poisoning?

Attackers perform DNS cache poisoning by inserting false DNS records into a DNS resolver’s cache, causing it to return incorrect IP addresses for legitimate domains. The DNS Cache stores previous query results to improve resolution speed—but when compromised, it silently redirects users to attacker-controlled destinations.

Unlike transient attacks, cache poisoning has a persistent impact, affecting all users who rely on the compromised resolver until the cache is cleared or expires.

How DNS Cache Poisoning Works

Attackers exploit weaknesses in DNS query validation or predictable transaction IDs to inject malicious responses into the cache.

Typical attack sequence:

1. A DNS resolver queries a domain (e.g., login.company.com).
2. The attacker floods the resolver with forged responses.
3. One malicious response is accepted and cached.
4. Subsequent requests resolve to the attacker’s IP address.

Because the poisoned entry resides in the cache, multiple users are impacted without direct interaction with the attacker.

DNS Cache Poisoning vs DNS Spoofing

Key distinction: DNS spoofing is a technique, while DNS cache poisoning is the resulting condition when spoofed data is stored persistently.

Common Impacts of DNS Cache Poisoning

• Credential harvesting: Redirecting users to convincing phishing portals
• Malware delivery: Hosting malicious payloads behind trusted domains
• Session hijacking: Intercepting authenticated traffic
• Reputation damage: Compromising legitimate brand domains

Preventive Measures

• Implement DNSSEC: Cryptographically validates DNS responses
• Use randomized query parameters: Increases entropy against forgery
• Limit recursion: Restrict resolver usage to trusted clients
• Monitor DNS traffic: Identify anomalies and suspicious patterns
• Flush caches regularly: Reduces dwell time of poisoned records

FAQs

What is DNS cache poisoning in simple terms?
Attackers trick a DNS server into storing incorrect website information, causing it to redirect users to malicious sites without their knowledge.

Is DNS cache poisoning the same as DNS spoofing?
No. DNS spoofing is a method used to forge DNS responses, while DNS cache poisoning occurs when that forged data is successfully stored and reused.

How long does DNS cache poisoning last?
It depends on the DNS record’s TTL (Time to Live). The attack persists until the cache expires or is manually cleared.

Can DNS cache poisoning affect HTTPS websites?
Yes, but HTTPS may trigger certificate warnings, alerting users to potential tampering.

How can organizations detect DNS cache poisoning?
Look for unexpected IP resolutions, traffic anomalies, and inconsistent DNS responses across endpoints.