Cache Poisoning

DNS cache poisoning (also called DNS spoofing) tricks a recursive resolver into storing a forged answer for a domain. Once the bad record is cached, every user of that resolver gets sent to the attacker's IP until the TTL expires. Dan Kaminsky's 2008 demonstration was the canonical example: it exploited weak transaction-ID entropy plus the ability to retry against any subdomain to race legitimate responses, and forced an industry-wide patch within weeks. Modern defences layer source-port randomization (RFC 5452), 0x20 query-name case randomization, DNS cookies (RFC 7873), and DNSSEC validation, which cryptographically rejects forged answers regardless of how they arrived. Operators should validate DNSSEC and use a resolver that implements all four.