Domain-Name System Cache Poisoning

What DNS cache poisoning is and why it matters

DNS cache poisoning corrupts a resolver’s cache with false name-to-address records. The practical danger is simple: users, applications, and security tools can be redirected to an attacker-controlled destination while the bad mapping remains trusted.

This is not just a lookup error. DNS is often a shared control plane for web access, mail delivery, software updates, and internal service discovery, so a poisoned cache can disrupt many downstream systems at once.

How cache poisoning works in the DNS resolution path

A resolver accepts responses that appear to match an outstanding query and stores them for later use. If an attacker can inject a forged response fast enough, or can influence a weak validation path, the resolver may cache the attacker’s answer instead of the authoritative one.

The abuse usually succeeds when the resolver cannot reliably distinguish authentic responses from spoofed ones. That can involve weak source validation, predictable query patterns, poor entropy in request matching, or trust placed in a response that arrives before the legitimate answer.

What changes when poisoned records are cached

Once a false record is cached, every client relying on that resolver can be sent to the wrong IP address until the record expires or the cache is flushed. That makes the blast radius larger than a single request because the compromise persists across repeated lookups.

The impact depends on what the poisoned name represents. A web domain can be redirected to a phishing site or malware host, while internal service names can cause outages, man-in-the-middle exposure, or failure of application dependencies that expect a specific destination.

How organisations reduce exposure and recover trust

Exposure starts with knowing which resolvers are in use, who can reach them, and whether they accept recursion from untrusted networks. DNS cache poisoning is much easier to exploit when resolvers are broadly exposed, poorly monitored, or weakly configured.

Defence depends on stronger resolver validation, DNSSEC where it is deployed end to end, restrictive recursion, and careful logging of resolver behaviour. For broader DNS hardening guidance, see the DNS Security Guide.

When the poisoned destination is a web property, related trust boundaries matter too. A poisoned lookup can be paired with host header abuse, reverse-proxy confusion, or origin exposure, so the Host Header Attacks and Validation Guide is useful context for understanding how name resolution errors can amplify application-level trust failures.

Risk and Threat Considerations

Cache poisoning is attractive because it turns one successful forged response into repeated misdirection. The attacker does not need to win every lookup, only the first one that lands in cache, after which the resolver may serve the bad mapping to many clients.

Failure mechanism: The resolver accepts an unauthenticated or weakly validated response and stores a false mapping long enough for downstream clients to follow it.

Impact: Users can be redirected to malicious infrastructure, internal traffic can be diverted or disrupted, and incident response becomes harder because the wrong destination looks legitimate from the client side.

Practitioner Guidance

Why practitioners should care: DNS cache poisoning is a control-plane failure, not just a hostname error. If the resolver layer is trusted by browsers, APIs, email systems, and internal services, one poisoned record can affect many business processes at once.

What to watch for: Look for unusual resolver answers, unexpected IP changes for stable names, spikes in negative or mismatched responses, and traffic that resolves correctly in some places but not others. That pattern often indicates poisoning, split-horizon confusion, or a weak validation path that needs review.

For attack-path context and defensive detection ideas, the Man-in-the-Middle Attacks Guide and the MITRE ATT&CK T1557 Adversary-in-the-Middle guide help connect DNS poisoning to broader interception and relay techniques.

Related resources from NHI Mgmt Group

• Guide: Web Cache Poisoning and Cache Deception Guide
• What happens when a warm disaster recovery instance uses a different domain name from the production system?
• How does Dynamic Domain Name System (DDNS) work?
• What attacks target Dynamic Domain Name System (DDNS)?
• How does Domain Name System Service Discovery work?