DNS spoofing: What it is, why it is used, and how to avoid it

DNS is what translates website names into IP addresses so your device knows where to connect. Unfortunately, hackers can exploit this process to redirect you to malicious websites. That’s DNS spoofing in a nutshell, and attackers can go about it in several ways.

They can tamper with DNS servers, manipulate DNS requests, or change the DNS settings on your device or router, sometimes with malware. However, HTTPS, encrypted DNS, VPNs, and up-to-date security software can make these attacks much harder to pull off.

Read on for a more in-depth explanation of how DNS spoofing works and how it differs from DNS cache poisoning. You’ll also find the potential risks of DNS spoofing and ways to protect yourself, including steps for checking your DNS settings on all major platforms.

What is DNS spoofing and how does it work?

DNS, or Domain Name System, translates website names like privacy.net into numeric IP addresses that your device can use to connect to them. Your device sends a DNS request to a resolver, which looks up the address and sends it back.

DNS spoofing happens when someone interferes with that process and swaps in a false IP address. Your device then connects to the wrong server, which could host a phishing page, malware, or another service controlled by the hacker.

Attackers can spoof DNS in several ways, such as:

• Tampering with a DNS resolver: If an attacker gains access to a DNS resolver, they can alter its records or configuration, so it returns the wrong IP address for a domain. This requires compromising the resolver or having admin access, so it’s generally harder than attacking an individual device. For most internet users, your resolver is run by your internet service provider.
• Interfering with DNS traffic: If your web browser doesn’t encrypt DNS requests, an attacker can use techniques such as DHCP hijacking or a man-in-the-middle (MITM) attack to intercept and modify the request.
• Changing DNS settings: An attacker can make DNS changes on your device or router, either manually (if they have physical access) or with DNS changer malware. This can point your requests to a rogue DNS server that redirects you to phishing or malware sites.

Is DNS spoofing the same as DNS cache poisoning?

While closely related, the terms describe slightly different things. DNS spoofing is the broader term for attacks that provide fake DNS info and send you to the wrong address.

Meanwhile, DNS cache poisoning is a specific type of DNS spoofing that targets cached DNS records. If an attacker places a false record into a resolver’s cache, it can return the wrong IP address to other devices that request the affected domain.

What are the risks of DNS spoofing?

DNS spoofing can have different consequences depending on what you’re connecting to and how well that service protects your traffic. Here are the main risks to keep in mind:

• Phishing: An attacker can send you to a fake website that looks like the real thing, hoping you’ll enter your password, payment details, or other personal information.
• Malware: Similarly, you could be redirected to a malicious site that tries to trick you into downloading malware or running an unsafe file.
• Traffic interception: Hackers can redirect your connection through a server they control, potentially letting them read or modify unencrypted traffic. This is less common these days, since HTTPS now protects most web traffic from being read in transit.
• Network disruption: An attacker can send you to the wrong address or a nonexistent one, preventing websites and other network services from working properly.

How to prevent DNS spoofing

You can reduce the risk of DNS spoofing by protecting your DNS requests and checking that the websites you visit are legit. Here are the main ways to do so:

1. Check for HTTPS

HTTPS encrypts (or scrambles) the traffic between your browser and a website, while its certificate helps your browser verify that you’re connecting to the right domain. Look for https:// at the start of the URL before entering any sensitive information.

If DNS spoofing sends you to a different server, its certificate won’t match the domain you entered, so your browser should show a security warning. Still, a fake site can have its own valid HTTPS certificate, so check the URL carefully.

2. Use encrypted DNS

Using encrypted DNS prevents people on the network from easily reading or altering your DNS requests. DNS over HTTPS (DoH) and DNS over TLS (DoT) both encrypt the connection between you and your DNS resolver.

Many modern browsers enable encrypted DNS by default, though it’s a good idea to check your browser’s DNS or privacy settings to make sure. Note that encrypted DNS doesn’t protect you against a malicious resolver, so choose one you trust.

3. Use a VPN

A VPN sends your DNS requests through an encrypted tunnel, making them harder for someone on the local network to intercept or modify. This can help when you’re using public WiFi or another untrusted connection.

You can run a DNS leak test before and after connecting to your VPN to check whether your DNS requests are going through the tunnel. Before connecting, the test may show DNS servers belonging to your ISP or local network. After connecting, you should see servers associated with your VPN provider instead.

A reputable VPN should also use DNS leak protection to prevent requests from escaping the tunnel. If the test still shows your ISP’s DNS servers while the VPN is connected, check the VPN’s DNS leak settings or contact customer support to report the issue.

4. Keep your security software updated

DNS changer malware can modify your device’s DNS settings or interfere with your network connection. Whether you’re using Windows Defender or a third-party antivirus, keep it updated so it can detect and block newer threats.

Keep your operating system and browser updated, too. Attackers can exploit other vulnerabilities to gain access to your device. AI tools are also making it easier to find security flaws and create or modify malware, giving attackers more ways to exploit outdated software.

5. For advanced users: DNSSEC

DNSSEC adds digital signatures to DNS records, allowing a validating resolver to check that a response came from the domain owner and hasn’t been altered. This can prevent forged DNS responses from being accepted.

DNSSEC mainly matters to people who manage DNS for websites, companies, or networks, since your DNS resolver normally handles validation for you. It also authenticates DNS data without encrypting the DNS requests themselves.

How to check your DNS settings

By default, most devices get their DNS servers automatically from your router or internet provider. You can check these settings to make sure they haven’t been changed to an unfamiliar DNS server:

• Windows 11: Right-click the WiFi icon on the bottom right and select Network and Internet settings. Go to Wi-Fi > Hardware properties and look for DNS server assignment. If it says Automatic (DHCP), your DNS settings come from the network. Click Edit if you want to manually set your DNS server.
• macOS: Click the Apple menu and go to System Settings > Network. Select your WiFi connection, click Details, then DNS. Check the DNS Servers list for any unfamiliar entries.
• Android: Go to Settings > Network & internet > Private DNS. Here, you can see whether Private DNS is set to Off, Automatic, or a specific Private DNS provider hostname. The exact menu can vary by manufacturer, so search Settings for Private DNS if you can’t find it.
• iOS and iPadOS: Go to Settings > Wi-FI and tap the ( i ) button next to your network. Tap Configure DNS to see whether it’s set automatically or using a manually entered server address.
• Routers: Open your router’s admin page, usually by entering 192.168.0.1 or 192.168.1.1 in your browser’s address bar. Sign in with the credentials in your router manual or label, then look under Internet, WAN, Network, or DHCP settings for the DNS server entries. The exact location varies by router.

What is DNS spoofing? FAQs