DNS Spoofing

DNS spoofing forges or corrupts a DNS answer so a victim resolves a legitimate hostname to an attacker-controlled IP instead. It can be done on-path by racing the real response, off-path by poisoning a resolver’s cache, or by simply handing out a rogue resolver over DHCP. It’s a man-in-the-middle technique usually set up with ARP spoofing, and it directly abuses trust in DNS on port 53.

How It Works

An on-path attacker races the legitimate DNS server, returning a forged answer before the real one arrives. Off-path attackers attempt Kaminsky-style cache poisoning against a resolver, or supply a rogue resolver via a compromised DHCP server. NXDOMAIN hijacking rewrites failed lookups into attacker-controlled pages. Once a hostname resolves to the attacker, the victim lands on a page built for credential capture or phishing.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

How to Detect It

• Compare resolved answers against authoritative records for critical hostnames.
• Watch for duplicate or racing DNS responses to the same query.
• Alert on an unexpected resolver appearing in DHCP leases, and flag unusual TTL values.

How to Defend Against It

• Deploy DNSSEC so responses are cryptographically validated.
• Use DoH/DoT to authenticated resolvers so answers can’t be tampered with in transit.
• Randomize source ports and transaction IDs, enable DHCP snooping, and monitor continuously for rogue resolvers on the network.

Validating Your Defenses

An authorized test confirms whether forged DNS answers are actually rejected end to end, not just blocked on paper. Capture every redirected lookup and the resulting session so it lands in the pentest report as concrete evidence.