What is DNS spoofing?
Domain Name System (DNS) spoofing, also commonly referred to as DNS cache poisoning, is a DNS attack where DNS records or communication are intercepted and altered in order to route users to a different IP address. In a DNS spoofing attack, attackers may manipulate a DNS response with false information so a legitimate DNS query resolves to a fraudulent destination instead of the intended site. This kind of dns spoof can undermine DNS security because users may be sent to attacker-controlled sites even when they entered the correct web address.
How DNS spoofing redirects users
In a spoofing attack, traffic from legitimate servers is rerouted to fraudulent sites that may look like the legitimate website the end-user was trying to get to. These attacks can happen seamlessly without giving any indication to the user of what is happening.
What happens when users reach the fake site
When the user arrives at the fake site, they may be prompted to enter their login credentials or reveal sensitive data like credit card data, bank account numbers and Social Security information. This malicious website may be supported by a fake DNS record that makes the destination appear legitimate to the user’s browser.
Attackers can then use this information to steal money, data and identities, or to access corporate networks to launch other attacks.Once a DNS record has been spoofed, the cyber attacker can install worms or viruses on a user’s computer, giving the attacker unfettered access to the data provided.
How does DNS spoofing work?
To fully understand how DNS spoofing works, it is helpful to have an understanding of how the internet routes users to websites. Once that routing process is clear, it becomes easier to understand how a spoofed DNS response can send users to the wrong destination without raising immediate suspicion.
DNS connects domains to IP addresses
Every server has its own unique thumbprint called an internet protocol (IP) address that is composed of a series of numbers. Each IP address is mapped to a corresponding domain name (www.example.com) that properly routes users to the website.
Attacking normal DNS communication
When a user enters a website address, their device sends a DNS query to a DNS resolver, often operated by an internet service provider. If the resolver does not already have the IP address stored in its cache, it checks with other DNS servers, moving from a root server to a top-level domain server such as .com or .org, then to the domain’s authoritative name server. Once the correct IP address is returned, the resolver sends it back to the user’s device so the browser can connect to the intended website.
Attackers manipulate DNS routing
To spoof a DNS, cyber attackers find and exploit weaknesses in this process to redirect traffic to an illegitimate IP address and fake website. In many cases, the attacker targets how DNS servers, resolvers, or local DNS software handle requests and responses, especially when outdated systems fail to validate whether the returned information is trustworthy.
Poisoned DNS lookup
During a normal DNS lookup, the browser asks a DNS resolver to match a domain name with the correct IP address. DNS spoofing corrupts this process by returning a malicious destination instead of the real IP address associated with the intended site.
4 different methods of DNS cache poisoning
There are several types of DNS spoofing, but the most common ones are:
- Man-in-the-middle duping: The attacker gets between your browser and DNS server to infect both using a tool to synchronously poison your local device and DNS server. This results in a redirect to a malicious site hosted on the attacker’s local server.
- DNS cache poisoning by spam: URLs included in spam emails and banner ads on untrustworthy websites are compromised with a virus. When the user clicks on the URL, their computers are then infected with the virus located in the malicious URL. Once infected, the user's device will route to fake websites that look like the real thing.
- DNS server hijack: The cyber attacker reconfigures the server to direct any traffic to the spoofed domain. This type of cache poisoning attack can be especially dangerous when attackers combine DNS manipulation with phishing pages, malware delivery, or credential theft.
- TTL manipulation: Attackers may exploit DNS cache Time-To-Live values to keep false DNS records active for longer. When a poisoned DNS response remains cached, more users can be redirected to a malicious website even after the initial attack.
The dangers of DNS spoofing
DNS attacks account for 91% of malware attacks, and one out of every 13 web requests leads to malware. Common DNS spoofing risks include data theft, malware infection, censorship, and halted security updates that may expose devices to additional threats.
DNS spoofing can also create broader downstream risks. If attackers use a fraudulent website to install malware, they may gain enough access to deploy ransomware or move deeper into the affected environment. Because many organizations do not monitor DNS activity closely, stronger anti-spoofing solutions, DNS-layer visibility, cloud security controls, and threat intelligence can help identify suspicious domains, block risky destinations, and detect abnormal DNS behavior earlier.
How web security works
When a user initiates a request to access the Internet by entering an address in the browser or clicking a link in an email or website, a DNS request is forwarded to the Mimecast web security service . As Mimecast inspects and resolves the DNS request, acceptable use policies established by the organization are applied to the request, blocking access to content that is deemed inappropriate for business use.
At the same time, the target website is scanned for malicious content. If the site is determined to be safe, the user is granted immediate access. But if the site is deemed to be suspicious or malicious, Mimecast blocks access to the site and the user is notified via a message in the browser about the reason why.
Examples of DNS spoofing & DNS cache poisoning attacks
Cyber attackers are continually employing more sophisticated tactics to carry out DNS spoofing. Though no two attacks may be the same, a DNS spoofing scenario could look something like this:
- The attacker intercepts communication between a client and a server computer belonging to the targeted website.
- Using a tool such as arpspoof, the attacker can dupe both the client and the server to follow malicious IP addresses that route to the attacker's server.
- The attacker creates a fake website that the malicious IP address will route users to in an attempt to obtain sensitive information.
This kind of attack works because the user may see what looks like a familiar website while the underlying DNS response has already been altered. That is why DNS-layer monitoring, trusted DNS infrastructure, and web security controls are important for detecting suspicious redirects before users enter sensitive information.
