DNS Poisoning Explained | AP Cybersecurity
DNS Poisoning (DNS Spoofing) Explained
DNS poisoning (DNS spoofing) corrupts the system that translates domain names into IP addresses, so a user who types a legitimate address is silently sent to a malicious server.
Contents
How DNS poisoning works
DNS is the internet's address book: it turns a name like example.com into an IP address. In a DNS poisoning attack, the adversary inserts a false record so the name resolves to an IP they control.
The user sees the correct domain in their browser but lands on the attacker's server, where credentials or data can be harvested. Because the address looks right, it is hard to notice.
A user types their bank's real web address but reaches a convincing fake login page. The address bar shows the correct domain. What attack is likely?
Reveal answer
DNS poisoning. The name resolved to a malicious IP, so the legitimate-looking address sent the user to the attacker's server.
DNS poisoning is dangerous because the domain name still looks correct. The mismatch is between the name and the IP it resolves to, not in the URL the user typed.
Defending against DNS poisoning
Defenses include using trusted DNS resolvers, validating responses with DNSSEC where available, and watching for unexpected redirects. End users benefit from HTTPS, which makes impersonating a site harder because the attacker cannot easily present a valid certificate.
On the network side, securing DNS infrastructure and monitoring for anomalous resolution helps detect poisoning.
How does HTTPS help a user who has been DNS-poisoned to a fake bank site?
Reveal answer
The fake site usually cannot present a valid certificate for the bank's domain, so the browser warns of a certificate problem, giving the user a chance to stop.
The 2008 Kaminsky DNS flaw
Researcher Dan Kaminsky revealed a flaw that let attackers poison DNS caches at scale, redirecting users from legitimate sites. It triggered a coordinated global patch effort and pushed adoption of stronger DNS protections.
The domain looks right; the destination is not.
Key Terms
| DNS | The system that maps names to IP addresses. |
| DNS poisoning | Inserting a false name-to-IP record. |
| Resolver | The server that answers DNS queries. |
| DNSSEC | A protocol that validates DNS responses. |
Match It Up
Common Mistakes
Looking only at the typed URL
The user types the right name; the poisoning happens in resolution, so the URL looks correct.
Confusing it with phishing links
Phishing uses a wrong link; DNS poisoning corrupts a right name's resolution.
Ignoring certificate warnings
A certificate warning may be the only sign of a poisoned redirect.
Assuming only servers are targets
Poisoning a resolver or cache can affect many users at once.
Check for Understanding
Frequently Asked Questions
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
Prefer email? Reach me directly at [email protected]