DNS poisoning corrupts name-resolution data so a familiar domain leads to a malicious or incorrect destination. It matters because DNS translates human-readable domain names into the IP addresses computers use; an attacker who can divert that translation can misdirect a user before the web request reaches its intended site. section 7.7 section 7.0
A browser resolving https://www.example.com normally relies on a DNS resolver, which follows a chain of lookups: it finds a server for .com, then one for example.com, then obtains the address for www.example.com. This is a simplified view, but it shows the security-sensitive point: DNS supplies the address that determines where a request starts. section 7.7
DNS is designed to scale through many servers and caches. Browsers and operating systems cache lookups, while ISP or corporate DNS servers often answer requests without consulting an authoritative server. Those caches are attractive targets when an attacker wants to redirect traffic, because a bad resolution can be reused rather than limited to one lookup. section 7.7
A redirected visit
A user enters a domain they recognize. Their device first needs an IP address, so it asks its configured resolver. If poisoned resolution data returns an attacker-controlled destination, the user can be sent somewhere other than the site they intended to visit. The practical risk is not that the user typed the wrong name, but that the name was resolved incorrectly. section 7.7
Reduce the harm of DNS misdirection with layered safeguards:
- Use HTTPS for all communication to the web application. HTTPS mitigates the risks created when DNS poisoning sends traffic to the wrong destination. section 7.13
- Implement HSTS so communication to the application is done through HTTPS. section 7.13
- Enable DNSSEC on domains where feasible. section 7.13
- Treat DNS poisoning as one network risk among related misdirection threats, including doppelganger domains and attacks on certificates or encryption keys. section 7.0
