DNS Cache Poisoning
What is DNS Cache Poisoning?
DNS Cache PoisoningAn attack that inserts forged records into a DNS resolver's cache so subsequent queries return attacker-chosen addresses until the TTL expires.
DNS cache poisoning targets recursive resolvers by tricking them into accepting a forged answer that they then store and serve. To be believed, a spoofed reply must match the query name, arrive on the right UDP port, and carry the correct 16-bit transaction ID (TXID) — so classic attacks reduce to guessing or racing those fields before the genuine authoritative response arrives.
Dan Kaminsky's 2008 disclosure (CVE-2008-1447) made this practical: by forcing queries for random subdomains and flooding guesses at the 16-bit TXID, an attacker could keep retrying without waiting for a cached negative answer, poisoning the parent domain's NS record. The emergency fix was source-port randomization, expanding the guess space from 16 to roughly 32 bits. In 2020 researchers from UC Riverside and Tsinghua showed SAD DNS (CVE-2020-25705): a side channel in the Linux global ICMP rate-limit counter that lets an off-path attacker infer the open ephemeral source port, collapsing that gain. Linux patched it by randomizing the ICMP rate-limit counter (kernel 5.10+).
flowchart TD
A[Attacker triggers query for random.bank.com] --> R[Recursive resolver]
R -->|"UDP query, random TXID + src port"| NS[Real authoritative NS]
A -.->|"flood forged replies: guess TXID + port"| R
R --> M{Forged reply matches<br/>name + port + TXID<br/>before real answer?}
M -->|Yes| P[Poisoned record cached for full TTL]
M -->|No| L[Legit answer cached]
P --> V[All resolver clients redirected to attacker IP]Defences: DNSSEC (RFCs 4033–4035) cryptographically signs records so forged answers fail validation; 0x20 case randomization and query-name minimization add entropy; and encrypted transports (DoH/DoT) remove the plaintext UDP surface entirely. Short, conservative TTLs limit blast radius when poisoning does occur.
● Examples
- 01
The 2008 Kaminsky attack (CVE-2008-1447) that exploited port-predictability flaws in major resolvers.
- 02
SAD DNS (CVE-2020-25705), which revived poisoning via an ICMP rate-limit side channel.
● Frequently asked questions
What is DNS Cache Poisoning?
An attack that inserts forged records into a DNS resolver's cache so subsequent queries return attacker-chosen addresses until the TTL expires. It belongs to the Attacks & Threats category of cybersecurity.
What does DNS Cache Poisoning mean?
An attack that inserts forged records into a DNS resolver's cache so subsequent queries return attacker-chosen addresses until the TTL expires.
How do you defend against DNS Cache Poisoning?
Defences for DNS Cache Poisoning typically combine technical controls and operational practices, as detailed in the full definition above.
What are other names for DNS Cache Poisoning?
Common alternative names include: Cache poisoning, DNS spoofing (cache).