thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

DNS Cache Poisoning

Inserting false records into a DNS resolver's cache so users are directed to malicious IP addresses.

Definition

Attackers spoof DNS responses that reach the resolver before the legitimate one, exploiting predictable transaction IDs or source ports, as in the 2008 Kaminsky attack. All clients using the poisoned resolver are redirected until the TTL expires. DNSSEC validation and source port randomization mitigate it.

Example

A resolver caches a forged A record sending bank.example to an attacker-controlled server.

Exam tip

DNSSEC is the definitive answer for preventing DNS poisoning.

Related terms