DNS Spoofing: How It Works, Types and Protection with DNSSEC

What Is DNS Spoofing?

The Domain Name System (DNS) is the phone book of the internet. Computers connect via IP addresses. People prefer to remember names such as example.com. The DNS turns one into the other.

In DNS spoofing, attackers fake this lookup. You enter the right address, but your computer gets a wrong IP address. Instead of your bank, you land on a convincing copy.

The tricky part: the address bar shows the right name. Unlike phishing with fake links, there is no typo that could warn you.

How a DNS Query Works

1. You enter an address in the browser.
2. Your computer asks a DNS server, the so-called resolver. This is usually the server of your internet provider or your company.
3. If the resolver does not know the answer, it asks its way through other DNS servers up to the server in charge of the domain.
4. It stores the answer for a while, in the so-called cache.
5. Your browser connects to the IP address it was given.

An attacker can strike at any of these points. The classic DNS does not check whether an answer is genuine.

Types of DNS Spoofing

• DNS cache poisoning: the attacker slips a fake answer into a resolver's cache. All users of that resolver then get the wrong address. In 2008, the researcher Dan Kaminsky showed how this could be done in seconds. DNS servers around the world were then fixed.
• Man-in-the-middle on the local network: on a café's Wi-Fi, an attacker intercepts DNS queries and answers faster than the real server. See man-in-the-middle attack.
• Tampered router: malware or a weak password changes the DNS setting on the router. All devices on the network then ask a server run by the attackers.
• Tampered hosts file: malware writes wrong addresses directly onto the computer.
• Domain takeover: attackers gain access to the account at the registrar or DNS provider and change the records themselves. Then the wrong address applies to everyone worldwide.

Impact on Companies and Users

• Stolen login data: users enter their password on a fake login page.
• Malware: a Trojan is downloaded instead of a real update.
• Intercepted email: if the mail record (MX) is faked, emails end up with the attacker.
• Outages: customers can no longer reach your website or shop.
• Loss of trust: people who were cheated on a fake page of your company often blame you.

Detecting DNS Spoofing

• Certificate warnings: a warning on a well-known site is a serious sign. The fake site usually has no valid certificate. See SSL/TLS.
• Unusual IP addresses: DNS answers that point to unknown networks are suspicious.
• Comparison: if two independent resolvers give different answers, something is wrong.
• Logs: analyze DNS queries and answers in one place. See security logging and monitoring.
• Watch your own records: any unexpected change to the DNS records of your domains should trigger an alarm.

Protection with DNSSEC

DNSSEC (Domain Name System Security Extensions) adds digital signatures to the DNS. The owner of a domain signs its records. A resolver that checks DNSSEC can then tell whether an answer is genuine. Fake answers are rejected.

For DNSSEC to work, two sides must take part:

• The domain owner signs the zone. With many providers, this is one click in the admin panel. The German top-level domain .de has been signed since 2011.
• The resolver checks the signatures. Modern resolvers can do this, but it must be turned on.

DNSSEC does not encrypt anything. It only makes sure that answers are genuine and unchanged. Read more under DNS security.

Further Protective Measures

• DNS over HTTPS (DoH) and DNS over TLS (DoT): they encrypt queries between the device and the resolver. On this path, no one can read along or fake answers.
• Trusted resolvers: use resolvers that check DNSSEC and are well maintained. Set them centrally.
• Secure domain accounts: protect your accounts at the registrar and DNS provider with MFA. Turn on a lock against unwanted transfers (registrar lock).
• Keep routers and DNS servers up to date: install security updates and change default passwords.
• HTTPS with HSTS: the browser then enforces an encrypted connection. Without a valid certificate, no connection is made.
• Train staff: never click certificate warnings away; report them.

Dangling DNS Records

A related risk is DNS records that still point to a service that no longer exists, such as a deleted cloud instance. Others can create this service again and then show content under your name. This is called subdomain takeover. SnapScan spots open cloud storage and dangling DNS records without login data.

Conclusion

DNS spoofing quietly sends users to the wrong servers, even though they enter the right address. The most important protection is DNSSEC, backed by encrypted DNS queries, well-secured domain accounts and HTTPS with valid certificates. If you take certificate warnings seriously and watch your DNS records, you spot attacks early.