---

DNS Cache Poisoning (Forged Responses in Resolver Cache)

1. Introduction

DNS cache poisoning (also called DNS spoofing) is a cyberattack in which an attacker inserts false DNS records into a resolver’s cache, causing users to be redirected to malicious or incorrect destinations. (DNSFilter)

Because DNS resolvers are widely shared (e.g., ISP DNS), a single successful attack can impact many users simultaneously.

---

2. Background: How DNS and Caching Work

The Domain Name System (DNS) translates human-readable domain names (like example.com) into IP addresses.

To improve performance:

• DNS resolvers cache responses

• Cached entries are reused until their TTL (Time To Live) expires

This caching mechanism improves speed—but also creates a target for attackers. (DNScale)

---

3. What is DNS Cache Poisoning?

DNS cache poisoning occurs when:

• An attacker injects forged DNS responses

• The resolver accepts and stores the fake data

• Future queries return the malicious IP address instead of the real one

As a result, users are silently redirected to attacker-controlled systems. (Cloudflare)

---

4. How the Attack Works (Step-by-Step)

Step 1: Trigger a DNS Query

The attacker forces a resolver to query a domain (e.g., victim.com).

Step 2: Send Forged Responses

The attacker floods the resolver with spoofed DNS replies, pretending to be the authoritative server.

Step 3: Guess Validation Fields

To succeed, the attacker must correctly guess:

• Transaction ID (TXID)

• Source port

• Query details

Step 4: Win the Race

If the fake response arrives before the legitimate one and matches expected values:

• The resolver accepts it as valid

• Stores it in cache

Step 5: Cache Gets Poisoned

Now:

• All future users querying that resolver receive the fake IP address

This exploit relies on a race condition in DNS resolution. (DNScale)

---

5. Example Scenario

1. User enters bank.com

2. Resolver returns attacker’s IP (due to poisoned cache)

3. User lands on a fake banking website

4. Credentials are stolen

The URL appears correct, making the attack highly deceptive.

---

6. Why DNS Cache Poisoning is Dangerous

• Scalable impact: affects thousands of users at once

• Invisible attack: no obvious signs for users

• Enables further attacks:

  • Phishing

  • Malware distribution

  • Traffic interception

Poisoned entries may persist until cache expiry, prolonging the attack. (Cloudflare)

---

7. Common Attack Techniques

• Transaction ID guessing (16-bit field)

• Source port prediction

• Flooding with forged responses

• Kaminsky attack (mass querying of random subdomains to increase success probability)

These techniques exploit weaknesses in DNS’s lack of authentication.

---

8. Real-World Impact

DNS poisoning incidents have caused:

• Internet-wide redirection failures

• Accidental censorship propagation across networks (How-To Geek)

This demonstrates how poisoned data can spread across multiple DNS servers.

---

9. Defenses Against Cache Poisoning

a) DNSSEC (DNS Security Extensions)

• Uses cryptographic signatures

• Ensures DNS data authenticity

• Prevents acceptance of forged responses

b) Randomization

• Random TXID and source ports increase entropy

• Makes guessing significantly harder

c) Bailiwick Checking

• Resolver only accepts responses from trusted authoritative sources

d) Short TTLs

• Reduces duration of poisoned entries

---

10. Conclusion

DNS cache poisoning exploits the trust and caching behavior of DNS by inserting forged responses into resolver caches. Once successful, it can redirect large volumes of traffic without directly compromising users’ devices.

Modern defenses like DNSSEC and improved randomness have reduced the risk, but the attack remains a critical concern in network security.

---