Attack: DNS spoofing and cache poisoning
A resolver turns a name like www.example.com into an address by asking other servers and trusting the first reply that matches. This lesson shows how an attacker can slip a forged reply into that moment, poison the resolver's cache, and send everyone to the wrong server — and why randomising the source port made it far harder. It ends by pointing to the defence: DNSSEC and encrypted DNS.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01A resolver sent a query and is waiting for the answer. Which reply will it accept?
RFC 5452: the reply must match the outstanding query on all of those fields, and the first match wins. UDP has no handshake, so the sender address on a reply is not proof of who sent it.
02Why can an attacker who cannot even see the query still sometimes get a forged reply accepted?
It is a race. Before 2008 most resolvers reused one fixed source port, so the attacker only had to guess the ID. It sends many forged replies with different IDs, each claiming a false address; if one carries the right ID and reaches the right port first, it is accepted.
03What makes cache poisoning so damaging compared with fooling one computer once?
A resolver serves many users. One accepted forgery sits in the cache for the attacker-chosen TTL, so every later lookup gets the wrong address until it expires.
04How did source-port randomisation (RFC 5452) make guessing harder?
With a fixed port the odds were 1 in 65,536 per forged reply. Adding an unpredictable source port multiplies the space to roughly 4.2 billion, so an off-path burst is far less likely to win.
05Why is spoofing easier for an attacker on your own local network?
An on-path attacker that has fooled your machine with ARP spoofing receives the query itself. It can then send a perfectly matching forged reply, with no guessing — which is why the defences in the next lesson matter.
Glossary
- Resolver
- A recursive DNS server that looks names up for you by asking other servers, and caches the answers to reuse them.
- Transaction ID
- A 16-bit number in every DNS message; a reply must copy the query's ID, so it acts like a ticket number the answer has to quote.
- Source port
- The number the resolver sends its query from. Before 2008 many resolvers reused one fixed port; RFC 5452 says to pick it at random so a forged reply must also guess it.
- Cache poisoning
- Getting a resolver to store a false record, so it then hands the wrong answer to everyone who asks until the record's TTL expires.
- Spoofing
- Putting a false source address on a packet. DNS uses UDP, a quick one-shot message with no handshake, so a reply can claim to come from a server it did not.
- ARP spoofing
- On a local network, falsely claiming another device's IP address (such as the router's) so its traffic is sent to you. It puts an attacker on the path, where it can read queries instead of guessing.
- TTL
- Time to live: how many seconds a record may be cached. An attacker picks a long TTL so a poisoned record lingers.
- Kaminsky technique
- A 2008 method (CVE-2008-1447) of forcing fresh races with made-up names; it led to source-port randomisation across DNS software.
Notes and sources
- 192.168.1.10 is private RFC 1918 space; 198.51.100.53, 192.0.2.53, 203.0.113.10 and 198.51.100.66 are RFC 5737 documentation addresses. IDs, ports and the attacker's TTL are illustrative.
- RFC 5452 §3: a resolver accepts a response only if its question, ID, source address and destination port match a query it is still waiting on; the first one that matches wins.
- The 2008 technique (CVE-2008-1447) was fixed in a coordinated patch of DNS software that added source port randomisation, later written down in RFC 5452.
- Forging the sender address only works from networks that do not filter outgoing traffic; BCP 38 (RFC 2827) asks every network to drop packets with source addresses that are not its own.
- HTTPS still helps: the attacker's server cannot show a valid certificate for www.example.com, so the browser warns instead of loading the page (see the HTTPS lesson).
- The fix is in the next lesson, "Defence: DNSSEC and encrypted DNS": DNSSEC signatures let a resolver reject forged records; DNS over TLS or HTTPS hides and protects the query on the way.
Quiz Unlocks after the last step.