DNS spoofing means forging DNS answers: the attacker makes a name resolve to the wrong address — users land on their servers while the browser shows the correct address. Cache poisoning is the most effective variant: the forged answer is planted into a resolver and distributed from its cache to all users.
The root of the problem: classic DNS has no authenticity check — whoever delivers a formally matching answer first wins. This credulity stems from the early internet and has not been fixed comprehensively to this day.
How the forgery succeeds — and what prevents it
In cache poisoning the attacker floods a resolver with forged answers to a query they triggered themselves; if one matches the transaction data of the real query, the cache adopts the forgery — and distributes it to all clients for the lifetime of the entry. Locally, simpler means suffice: manipulated routers or ARP spoofing redirect DNS traffic directly.
The structural answer is DNSSEC: signed zones make every forgery cryptographically detectable — a validating resolver discards it. Encrypted DNS (DoH/DoT) additionally protects the path between client and resolver. Together they take away both the ground and the transport of the attack.
Why this is business-critical
- Redirected users enter credentials on look-alike portals.
- Systems are hit too: API calls and update servers follow the same resolution.
- Email delivery can be diverted via forged MX answers.
- The damage hits your brand — on servers that never belonged to you.