DNS cache poisoning is an attack in which a forged DNS answer is accepted by a recursive resolver and stored in its cache. Every client using that resolver then receives the false address until the entry expires.
Why it matters
One poisoned resolver can redirect thousands of users to a phishing or malware site while the browser still shows the correct domain name. The best-known case is the 2008 Kaminsky attack, which showed that off-path attackers could guess the query transaction ID quickly. Modern resolvers defend with source port randomization, random case in query names (0x20 encoding) and strict validation of what they accept. DNSSEC is the cryptographic fix, because forged records fail signature checks.
Example
A resolver asks for bank.example and the attacker floods it with spoofed replies containing the right transaction ID and port. If one lands before the real answer, the resolver caches:
bank.example. 86400 IN A 198.51.100.66With a high TTL, the damage lasts a day.
Common mistakes
- Running an old, unpatched or open resolver.
- Assuming HTTPS makes it harmless. Attackers can still obtain misleading certificates or exploit users who ignore warnings.
- Believing DoH or DoT stops it. They protect the client link, not resolver-to-server traffic.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.