A DNS cache temporarily retains lookup results so repeated requests can be answered without contacting upstream servers. Caching happens in the browser, operating system, ISP, and corporate network, making DNS more scalable but creating targets for traffic diversion. section 7.7
Security implications include:
- Attackers can poison caches to redirect users toward a different destination. section 7.7
- Editing /etc/hosts on Linux or C:\Windows\System32\drivers\etc\hosts on Windows can redirect traffic locally. section 7.7
- HTTPS limits the impact of diverted traffic because a fake site still needs a certificate and cannot automatically decrypt protected traffic. section 7.7
A layered lookup
A browser may obtain a domain’s address from its memory cache; otherwise the operating system or ISP DNS server may answer before an authoritative server is queried. section 7.7
