DNS Spoofing
DNS spoofing injects forged DNS responses to redirect victims to attacker-controlled servers. Cache poisoning targets recursive resolvers – a single poisoned cache entry redirects all clients using that resolver. DNSSEC cryptographically signs DNS records to prevent spoofing. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) encrypt queries.
Definition
DNS spoofing forges DNS responses to map legitimate domains to attacker-controlled IP addresses. The classic Kaminsky attack (2008) exploited DNS transaction ID predictability to poison recursive resolver caches – injecting a false record that persists for the TTL duration (potentially hours). All clients using that resolver receive the spoofed IP. On local networks, tools like ettercap or dnsspoof inject forged responses faster than the legitimate server can reply. At the ISP level, transparent DNS proxies can modify responses for censorship or ad injection. DNSSEC prevents spoofing by having authoritative servers sign records with cryptographic signatures (RRSIG) that resolvers validate against published keys (DNSKEY). However, DNSSEC adoption remains partial (~30% of domains). DNS-over-HTTPS and DNS-over-TLS encrypt the query channel but do not validate response authenticity like DNSSEC does.
Examples
- –dnsspoof -i eth0 (intercepts and spoofs DNS on local network)
- –dig +dnssec example.com (checks DNSSEC validation)
- –Unbound resolver: val-permissive-mode: no (enforces DNSSEC validation)
Related Protocols
Related Terms
Man-in-the-Middle (MITM)
A man-in-the-middle attack intercepts communication between two parties, reading or modifying traffic without either party's knowledge. TLS prevents MITM by authenticating the server via certificates and encrypting the channel. MITM succeeds when: TLS is absent (HTTP), certificate validation is disabled, or the attacker controls a trusted CA.
ARP Poisoning
ARP poisoning (ARP spoofing) sends forged ARP replies on a local network to associate the attacker's MAC address with another host's IP. This redirects traffic intended for the victim (usually the gateway) through the attacker, enabling man-in-the-middle attacks. Defense: Dynamic ARP Inspection (DAI) on managed switches.