1. Cache poisoning
A resolver remembers answers for their TTL. In a poisoning attack the attacker races the real server and gets a forged answer into that cache, so everyone who uses the resolver is sent to the wrong address until the entry expires. The best known version was described by Dan Kaminsky in 2008 and led resolvers to randomise the source port and query ID, which makes guessing far harder.
Defence: use a resolver that validates DNSSEC, and sign your own zone if your DNS host supports it. DNSSEC lets a resolver reject an answer that doesn't carry a valid signature.
2. Hijacking
Hijacking changes where a name or a device points, instead of tricking a resolver. Typical routes:
- Taking over the registrar or DNS host account, then pointing the domain at the attacker's server.
- Changing the nameservers at the registry.
- Changing the DNS setting on a home router or a device, often through malware or a default password.
Defence: two-factor sign-in on the registrar and DNS accounts, a registrar lock on the domain, and a strong router password. Check what your domain currently points to with the DNS lookup and the nameservers with the NS lookup.
Look at the records your domain publishes right now:
3. DNS leaks
A VPN is supposed to send your DNS queries through its tunnel. A leak happens when some of them still go to the resolver from your ISP or Wi-Fi network, which shows which sites you visit. It's a configuration problem, not an attack on DNS itself.
Defence: set the VPN to use its own resolver, and test while connected by checking which resolver answers your queries.
4. Tunneling
DNS is allowed through most firewalls, so malware sometimes hides data inside it. The data is encoded into long, random-looking subdomain names such as a8f3k2x9...example.net, and the answers, often TXT records, carry data back. The attacker runs the authoritative server for that domain and reads what arrives.
Defence: look for unusually long names, a high volume of queries to one rarely used domain and many TXT lookups. Filtering resolvers and DNS firewalls flag these patterns.
5. Amplification (a DDoS technique)
A small query can produce a much larger answer. An attacker sends queries with the victim's address forged as the sender, and open resolvers send the large replies to the victim. The resolver is being used, not attacked.
Defence: don't run an open resolver. Answer recursive queries only for your own clients, and apply response rate limiting.
6. Subdomain takeover
A record such as shop.example.com CNAME example.shopprovider.net becomes dangerous when the account behind it is deleted. If anyone else can claim that name at the provider, they now control content on shop.example.com.
Defence: remove DNS records when you stop using a service, and audit your CNAME records now and then with the CNAME lookup.
What helps against most of them
- DNSSEC for answers that can be proven genuine.
- Encrypted DNS between your device and the resolver. See DoH vs DoT.
- Locked, two-factor-protected registrar and DNS accounts.
- A short list of records you actually use, and alerts when it changes.