DNS spoofing redirects your browser to a fraudulent server by corrupting the lookup that turns a website address into an IP address, and it can happen without a single suspicious click on your end. You type a legitimate URL, hit enter, and land on a fake page built to steal your login or install malware, while the domain name in your address bar looks exactly like it should. The attack doesn't target you directly. It targets the DNS record your device trusts to find that site in the first place.
In short: DNS spoofing, also called DNS cache poisoning, plants a false IP address in a DNS resolver so that a real domain name resolves to an attacker's server instead of the legitimate one. It's been used to run large-scale malware campaigns like DNSChanger and to power on-path attacks on public Wi-Fi. The most reliable defenses are a resolver that supports DNSSEC, DNS over HTTPS, and checking for a valid HTTPS certificate on any site asking for credentials or payment details.
How DNS Spoofing Works
Every time you visit a website, your device asks a DNS resolver to translate the domain name into an IP address. That resolver either has the answer cached from a recent lookup or queries an authoritative server to get one, then stores the result for a set period called the time to live. DNS spoofing exploits that trust chain by inserting a false answer somewhere along it, so your device caches and acts on an IP address the attacker controls rather than the real one.
The record stays poisoned until its TTL expires or someone flushes the cache, which means a single successful spoof can redirect every user of that resolver for hours or days without any of them realizing the domain itself was never compromised.
DNS Spoofing vs. DNS Cache Poisoning
The two terms are used almost interchangeably, and for good reason: cache poisoning is the specific technique, and DNS spoofing is the broader outcome it produces. Cache poisoning refers to the act of injecting a forged DNS response into a resolver's cache. DNS spoofing refers to the result, which is any scenario where a domain resolves to an address the attacker chose instead of the correct one, whether that happened through cache poisoning, a compromised router, or a rogue network. In practice, most people use the two names to mean the same thing.
Common Ways Attackers Spoof DNS
Cache poisoning attacks target the resolver itself, usually by racing to inject a forged response before the legitimate one arrives, or by exploiting a resolver that doesn't randomize its query source ports and transaction IDs well enough to block guessing. The 2008 Kaminsky attack, named for security researcher Dan Kaminsky, exposed a flaw of exactly this kind that affected nearly every DNS server in use at the time.
Router DNS hijacking happens when malware or an attacker with access to your router's admin panel changes its DNS settings directly, usually because the router still has a default or weak admin password. Every device on that network then uses the attacker's DNS servers for every lookup until someone catches it and reverts the setting. The DNSChanger malware, dismantled by the FBI's Operation Ghost Click in 2011, infected an estimated four million computers this way and rerouted their DNS traffic through servers the operators controlled.
On-path attacks on public Wi-Fi let an attacker on the same network, often one running a lookalike hotspot, intercept and answer DNS queries before the legitimate server responds. This is one of the more common reasons security guidance singles out public Wi-Fi as risky: the network itself doesn't need to be broadly compromised, just positioned between you and the real DNS server.
Signs Your DNS Has Been Spoofed
A spoofed DNS setup rarely announces itself, but a few patterns are worth checking if something feels off. You're redirected to a different page than the one you expected, even though the address bar shows the correct domain. Your browser throws a certificate warning on a site that normally loads without one, because the fake server can't present a valid certificate for a domain it doesn't own. Pages load with unfamiliar ads, a different layout, or a login form asking for information the real site wouldn't normally request at that step. Your device's DNS settings, or your router's, show server addresses you didn't set, which you can check directly in your network configuration.
None of these alone confirms an attack, but a certificate warning on a site you visit regularly is the strongest single signal, since it means the page you're looking at genuinely isn't the one your browser thinks it's connecting to.
What Happens After a Successful Attack
The redirect itself is rarely the end goal. Attackers use spoofed DNS to route victims to convincing replicas of banking, email, or cryptocurrency exchange login pages, capturing usernames and passwords the moment they're typed in. Others use the redirect to push a fake software update or plugin that installs malware directly. DNSChanger's operators used their control over infected machines' DNS to redirect ad clicks and search results, generating an estimated $14 million in fraudulent ad revenue before the FBI shut the operation down.
Because the domain name itself was never altered, victims often don't realize anything happened until they notice a fraudulent charge, a locked account, or a device running slower than it should.
How to Protect Yourself From DNS Spoofing
A handful of changes meaningfully reduce your exposure. Switch to a DNS resolver that supports DNSSEC, such as Cloudflare's 1.1.1.1 or Google's 8.8.8.8, which cryptographically signs DNS records so a resolver can verify a response wasn't forged. Enable DNS over HTTPS or DNS over TLS in your browser or operating system settings, which encrypts the query itself so it can't be intercepted and answered by an attacker sitting on the same network. Change your router's default admin password and keep its firmware updated, since router hijacking depends almost entirely on that panel being left unsecured. Before you enter a password or payment details anywhere, check that the site shows a valid HTTPS certificate for the exact domain you meant to visit, not just a padlock icon.
Does a VPN Protect Against DNS Spoofing?
A reputable VPN helps, because it routes your DNS queries through an encrypted tunnel to its own resolver instead of sending them in the clear over whatever network you're connected to, which closes off the on-path attack that public Wi-Fi enables. It doesn't protect you if the poisoning happens further upstream, at a resolver or authoritative server your VPN provider itself relies on, and a low-quality VPN that doesn't run its own secure DNS infrastructure can leave you just as exposed as not using one.
FAQ
Is DNS spoofing illegal?
Yes. In the United States, DNS spoofing carried out to intercept communications, steal data, or commit fraud falls under the Computer Fraud and Abuse Act, and the operators behind large campaigns like DNSChanger have faced federal prosecution. Most countries with cybercrime statutes treat it the same way.
What's the difference between DNS spoofing and DNS hijacking?
The terms overlap heavily, but DNS hijacking usually refers to an attacker gaining control over a domain's actual DNS settings, often through a compromised registrar account, while DNS spoofing typically means forging a false response within the resolution process without ever touching the domain's real records. Either one can send you to the wrong server.
Can DNS spoofing affect phones and tablets?
Yes. Any device that relies on DNS to resolve domain names is exposed, and mobile devices connecting to public Wi-Fi hotspots are a common target for on-path DNS attacks specifically because people don't always think to check a certificate warning on a phone the way they might on a desktop browser.
If a site you visited recently threw a certificate warning, redirected unexpectedly, or asked for information that didn't match what you were doing, run the domain through ScamInfo's validator before entering anything else on it. For a broader look at how attackers manipulate the systems you rely on to reach legitimate sites safely, browse ScamInfo's knowledge base, and if you've already lost money or credentials to a spoofed site, file a report so the pattern gets tracked.