DNS Spoofing and Cache Poisoning
Applications use the Domain Name System (DNS) to turn names such as api.example.com into information such as IP addresses. If an attacker can corrupt that answer, a client may connect to the wrong server even though the user entered the correct name.
That redirection can affect websites, APIs, email delivery, software repositories, and any other system that discovers services through DNS. The application might disclose data to an attacker, download malicious content, or simply become unavailable.
Two related terms describe different scopes of this problem:
- DNS spoofing means causing a client or resolver to accept a forged DNS response.
- DNS cache poisoning means placing false DNS data into a cache so the bad answer is reused for later queries.
A forged answer that affects one lookup is DNS spoofing. If a shared recursive resolver caches it, the same forgery can affect thousands of users until the entry expires or is removed.
This chapter explains why classic DNS responses can be forged, how resolvers decide which response to accept, why cache poisoning has a larger blast radius, and how modern defenses address different trust boundaries.