DNS spoofing is an attack that feeds forged DNS responses to a resolver or client so a domain name resolves to an attacker-controlled IP address instead of the legitimate one. It includes DNS cache poisoning, where the resolver stores the false record (opens in new tab) in its cache and serves it to each user who queries that domain.
The victim sees the correct domain in the browser yet connects to a server the attacker runs.
How DNS spoofing works
DNS accepts answers by matching query fields without authenticating their origin. Queries and responses travel in single, unsigned UDP packets, a design that makes interception attacks (opens in new tab) easy for anyone on a shared or transit network. A resolver caches any response that arrives with the correct 16-bit transaction ID, source port, and query name.
The attacker's task is a race: land a matching forgery before the legitimate answer arrives, a window of milliseconds. Once the resolver accepts it, the poisoned record persists until its time to live (TTL) expires or an operator removes it.
Fixed source ports made cache poisoning practical in the 2008 Kaminsky vulnerability ( CVE-2008-1447 (opens in new tab)): resolvers sent queries from a single fixed port, so an attacker only needed to guess the transaction ID, and flooding the resolver with forged responses reliably poisoned it. The coordinated fix, source port randomization (opens in new tab), expanded the guessing space enough to make it impractical, until attackers revived it. An off-path attacker could infer the randomized port through ICMP rate limits and collapse the problem back to a transaction-ID guess, as the 2020 SAD DNS (opens in new tab) side channel (CVE-2020-25705) demonstrated.
Why DNS spoofing is hard to stop
A resolver cannot verify what already sits in its cache, so a single poisoned entry silently misdirects each user who queries that domain until the record expires. The victim can use a fully patched, malware-free device; even typing the correct address (opens in new tab) offers no protection, because the misdirection happens after the request leaves the device.
Attackers can also make the redirection hard to notice. During historical registrar compromises (opens in new tab) across the Middle East and North Africa, attackers diverted victims through credential-stealing servers (opens in new tab) and then passed them on to their real destination; the only observable symptom was a slight delay.
Few domain owners deploy the permanent fix, DNSSEC: most domains lack signatures, and recursive resolvers leave most queries unvalidated, which limits DNSSEC deployment (opens in new tab).
Types of DNS spoofing attacks
DNS spoofing reaches the victim through forged responses, while closely related DNS hijacking redirects traffic by changing resolver settings or authoritative records:
- Cache poisoning. The attacker injects forged responses into a recursive resolver, often using birthday-attack techniques (opens in new tab) that trigger multiple simultaneous queries for the same record to multiply the odds of a match.
- On-path interception. On shared networks, attackers use ARP poisoning or rogue Wi-Fi access points to sit between the victim and the resolver. An evil twin hotspot (opens in new tab) clones a legitimate network's SSID, then answers the victim's DNS queries directly.
- Router DNS hijacking. Attackers have scanned vulnerable routers (opens in new tab) and pointed their DNS settings at rogue servers that redirected banking customers to phishing domains (opens in new tab). Since at least August 2025, Russian military intelligence actor Forest Blizzard (opens in new tab) has replaced resolver configurations on poorly secured SOHO routers to intercept traffic.
- Authoritative DNS hijacking. A compromised authoritative name server (opens in new tab) lets an adversary who controls the server, or the registrar account above it, send bogus responses for every domain under that authority.
How to defend against DNS spoofing
No single control closes the gap, so DNS spoofing defenses layer several:
- Deploy DNSSEC. DNSSEC remains "the best current practice (opens in new tab) for adding origin authentication of DNS data." Signing your zones lets validating resolvers reject forged answers, but operators must also enable validation on their users' resolvers.
- Encrypt and control resolver traffic. Route DNS over HTTPS (opens in new tab) to an enterprise-controlled resolver and block all other encrypted resolvers, so endpoints cannot bypass monitoring.
- Use Protective DNS. Protective DNS services (opens in new tab) block queries to known-malicious domains (opens in new tab) and produce query logs for threat hunting and incident response.
- Harden resolvers. Separate authoritative and recursive functions, run DNS on dedicated systems under NIST SP 800-81r3, and apply resolver hardening measures (opens in new tab) against guessing attacks.
- Lock down registrar and DNS accounts. Audit public DNS records, update account passwords (opens in new tab), require MFA with phishing-resistant authenticators, and monitor certificate transparency logs for fraudulent certificates.
How Doppel helps
Beyond DNS controls, Doppel is the AI-native Social Engineering Defense (SED) (opens in new tab) platform that unifies Digital Risk Protection and Human Risk Management. It detects the lookalike domains (opens in new tab) and phishing sites a spoofed lookup sends victims to, then dismantles them.
The Doppel Threat Graph (opens in new tab) correlates domains, certificates, social handles, and phone numbers into campaign-level views (opens in new tab), while agentic AI (opens in new tab) executes takedowns at scale (opens in new tab). The platform also converts live detections into a Simulation campaign (opens in new tab) with one click, so employees practice the tactics attackers use while dismantlement raises the attacker's operating cost.
A guided demo shows the campaign infrastructure targeting your brand and the takedowns that dismantle it. Request a demo (opens in new tab) to get started.
Frequently asked questions about DNS spoofing
What is DNS spoofing?
Domain Name System (DNS) spoofing is the delivery of forged DNS responses so that a domain name resolves to an attacker-controlled IP address, bypassing the legitimate one. It includes DNS cache poisoning, where the resolver stores the false record in its cache and serves it to each user who queries that domain until the record expires. Victims see the correct web address in their browser while connecting to a server the attacker controls, which makes the attack nearly invisible.
What is the difference between DNS spoofing and DNS hijacking?
DNS spoofing forges responses to a resolver or poisons its cache, so the effect lasts only until the cached record expires. DNS hijacking changes resolver settings or authoritative DNS records, typically through malware or compromised router, nameserver, or registrar credentials, and persists until an administrator corrects them. Authoritative hijacking targets the DNS records (opens in new tab) on the nameserver, while router hijacking changes resolver settings; both last longer than a spoofed response and reach every user behind the compromised configuration.
Can HTTPS prevent DNS spoofing?
No. Transport Layer Security (TLS) does not authenticate DNS resolution, so a spoofed lookup still sends the user to the attacker's server. In many cases, the attacker cannot obtain a valid certificate for the real domain, and the browser shows a warning, but that warning protects only the users who heed it. In registrar-level campaigns (opens in new tab), attackers obtained valid certificates for the domains they redirected, so the padlock displayed normally. Domain Name System Security Extensions (DNSSEC), which cryptographically authenticates DNS data itself, is the control that addresses the resolution layer.
What is a real-world example of DNS spoofing?
Since early May 2026, Storm-2945, a sub-cluster of the Russian actor Midnight Blizzard, has manipulated DNS and HTTP traffic (opens in new tab) on hotel captive-portal networks worldwide in a campaign Microsoft named CaptiveCrunch. Attackers redirected travelers connecting to hotel Wi-Fi through actor-controlled infrastructure, including doppelganger domains mimicking Microsoft online services. The operation delivered malware and stole Microsoft 365 credentials and session tokens from victims who believed they were signing in normally.