# What is DNS Cache Poisoning?

> Domain Name System (DNS) cache poisoning occurs when a recursive resolver accepts false DNS data and stores it as though authentic.

- Canonical URL: https://yellowcube.eu/glossary/domain-name-system-cache-poisoning/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Later clients can receive the false mapping from the cache, redirecting traffic or causing failures until the entry expires, is replaced, or is removed. The attack corrupts cached resolution data; it does not require control of the domain’s registration or authoritative zone.

False data may arrive in a forged response or through a compromised resolution path. Strong matching makes off-path forgery harder. DNS Security Extensions (DNSSEC) validation rejects altered signed data when a trust chain exists, but does not authenticate unsigned zones or every client-to-resolver hop.

### Key points

- **Scope:** Identify affected resolvers, names and record types, when the record entered the cache, its remaining lifetime, and which clients or services received it.
- **Evidence:** Compare cache contents with authoritative data and validating resolvers, then review response logs, forwarding paths, changes, validation results, and redirected activity.
- **Risk reduction:** Maintain resolver software, use strong response matching and source-port entropy, restrict recursion and administration, validate DNSSEC where appropriate, protect resolver channels, and monitor unexpected changes.
- **Important limitation:** A surprising answer is not automatically poisoning. Caching, split DNS, forwarding, local overrides, load balancing, and configuration mistakes can produce answers that differ from public data; signing errors can also cause DNSSEC validation failures.

### Related terms

[Domain Name System (DNS)](<https://yellowcube.eu/glossary/domain-name-system/>) · [Domain Name System (DNS) security](<https://yellowcube.eu/glossary/domain-name-system-security/>) · [Domain Name System (DNS) hijacking](<https://yellowcube.eu/glossary/domain-name-system-hijacking/>) · [Time to live (TTL)](<https://yellowcube.eu/glossary/time-to-live/>) · [Pharming](<https://yellowcube.eu/glossary/pharming/>)

### Sources

[IETF RFC 5452: Measures for Making DNS More Resilient against Forged Answers](https://www.rfc-editor.org/rfc/rfc5452.html) · [NIST SP 800-81 Rev. 3: Secure DNS Deployment Guide](https://csrc.nist.gov/pubs/sp/800/81/r3/final) · [ICANN: DNSSEC—What Is It and Why Is It Important?](https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.