DNS spoofing and cache poisoning

August 6, 2025 · 1 min read · #network #dns #spoofing

DNS over UDP is unauthenticated by default. Whoever answers first with the right transaction ID wins.

Two variants

On-path spoofing: a MITM (or ARP spoofing) answers the query with a fake IP before the real resolver.

Cache poisoning (Kaminsky): off-path, guess the 16-bit transaction ID by flooding responses for random subdomains until one matches, injecting a malicious NS/A record the resolver caches and serves to everyone.

# historic defence: randomizing the source port adds ~16 bits of entropy

Defence

Transaction ID and source-port randomization (mandatory today). DNSSEC signs responses and blocks injection. DNS over TLS/HTTPS encrypts and authenticates the channel to the resolver.

« back to home