What Is DNS Poisoning?

DNS poisoning inserts false information into name resolution so that a name resolves to an address the attacker controls. The victim connects to the wrong place while everything appears normal.

It is powerful because name resolution precedes essentially every connection, and because nothing in the original protocol design verifies that an answer is genuine.

The variants

Cache poisoning — injecting a forged response into a resolver's cache, affecting every user of that resolver until it expires. Local modification — malware altering a host's own resolver settings or name file, affecting one machine.

Registrar or record compromise — changing the authoritative records for a domain, which is the most damaging because it is globally correct and entirely legitimate from the resolver's perspective.

What it enables

Traffic redirection to an attacker-controlled server, which supports credential harvesting from a convincing replica. Interception, since the attacker is now on the path — see man in the middle.

Mail redirection, by altering mail exchange records, which is quiet and extremely damaging. And certificate issuance, since many validation methods rely on control of the domain's records or the web server they point to.

Registrar security is the neglected part

The most consequential version requires no technical attack at all: compromise the account holding your domain registration and change the records.

The controls are ordinary and frequently absent: strong authentication with a second factor on the registrar account, registry lock preventing unauthorised transfers, a monitored role address rather than an individual's mailbox, and alerting on record changes.

Protections for resolution itself

DNSSEC cryptographically signs answers so forged ones are detectable, which is the direct technical answer and requires signing your own zones and validating on your resolvers.

Encrypted resolution protects queries from observation and tampering in transit, and moves trust to the resolver you choose — which is why permitting endpoints to use external encrypted resolvers directly removes your own visibility and control.

Detection

Resolution results that differ from expected values, which external monitoring of your own records detects. Certificates issued for your names without your knowledge, which certificate transparency monitoring surfaces.

Clients reporting certificate errors, which is frequently the first sign of interception. And unexplained changes to registrar or zone configuration, which should generate an alert regardless of who made them.

The subdomain takeover variant

A record still pointing at a cloud resource that has been deleted can frequently be claimed by whoever provisions that resource name next, giving them a legitimate, certificated host on your domain — no poisoning required, because the record genuinely points at them.

It arises from ordinary decommissioning where the resource is removed and the record is not. Auditing your zones for entries pointing at resources that no longer exist is a short exercise and closes one of the few routes by which an outsider obtains a real presence on your domain.

Where to start

Check that your registrar account has a second factor, a registry lock, and a monitored address rather than an individual's mailbox. It is the highest-consequence account most organisations have not reviewed.

See DNS security. GuardsArm runs security program reviews.