DNS Security: Why the Internet Phone Book Fails

What DNS Does

Every website lives at an IP address — a numeric address like 142.250.80.46. But humans navigate the web using domain names like google.com. The Domain Name System (DNS) is the infrastructure that translates human-readable domain names into IP addresses your device can connect to.

When you type a URL into your browser:

1. Your device checks its local DNS cache. If it finds a recent answer, it uses it.
2. If not, it sends a DNS query to a recursive resolver — typically provided by your ISP or a configured service like Google (8.8.8.8) or Cloudflare (1.1.1.1).
3. The resolver queries root nameservers, then top-level domain (TLD) servers, then the authoritative nameserver for the domain.
4. The IP address is returned, cached with a time-to-live (TTL) value, and your browser connects.

This entire process takes milliseconds but happens for virtually every internet connection you make.

The Security Problem with Traditional DNS

Traditional DNS has a fundamental design flaw: queries and responses are sent in plaintext over UDP, with no authentication. This means anyone monitoring your network — your ISP, a coffee shop Wi-Fi operator, or a man-in-the-middle attacker — can see every domain you look up.

Worse, DNS was designed with no mechanism to verify that a response actually came from the legitimate authoritative server. This opens the door to several attacks.

DNS Spoofing and Cache Poisoning

DNS spoofing (also called DNS cache poisoning) is an attack where malicious DNS responses are injected into a resolver's cache. When the cache is poisoned:

• A user queries yourbank.com
• The resolver returns an attacker-controlled IP address instead of the real one
• The user is redirected to a fake phishing site, often visually identical to the real one
• Credentials, session tokens, or payment data are harvested

The classic attack (Kaminsky attack, 2008) exploited predictable DNS transaction IDs and source ports to flood a resolver with forged responses. Modern resolvers randomize source ports and transaction IDs, but the fundamental authentication problem persists without DNSSEC.

DNS Hijacking

DNS hijacking differs from spoofing — instead of poisoning a cache, the attacker changes the DNS configuration at a higher level:

• Router hijacking: Malware or an attacker who accessed your home router changes its DNS settings to point to a malicious resolver.
• ISP-level hijacking: Some ISPs redirect failed DNS queries (e.g., misspelled domains) to their own ad-serving pages — a mild form of hijacking.
• Registrar hijacking: If an attacker gains access to a domain's registrar account, they can change the authoritative nameserver to redirect all traffic.

DNSSEC: Cryptographic Authentication for DNS

DNSSEC (DNS Security Extensions) adds digital signatures to DNS records. When a zone is DNSSEC-signed:

• Each DNS record is signed with a private key
• The corresponding public key is published in the DNS zone itself
• A chain of trust extends from the root zone down to individual domain records
• Resolvers can verify responses are authentic and untampered

DNSSEC prevents cache poisoning because forged responses fail signature verification. However, DNSSEC does not encrypt DNS — it authenticates records but queries and responses remain visible.

Not all domains are DNSSEC-signed, and not all resolvers validate DNSSEC signatures, which limits its real-world protection.

DNS-over-HTTPS and DNS-over-TLS

To address the privacy problem, two protocols encrypt DNS queries:

DNS-over-HTTPS (DoH): Wraps DNS queries inside standard HTTPS traffic on port 443. This makes DNS queries:

• Encrypted and unreadable to ISPs and network observers
• Indistinguishable from regular web traffic (harder to block)
• Authenticatable via standard TLS certificate verification

DNS-over-TLS (DoT): Encrypts DNS queries using TLS but uses port 853, which is distinct and can be blocked by network administrators. More transparent for network management.

Major browsers (Firefox, Chrome, Edge) support DoH and can be configured to use it. Cloudflare's 1.1.1.1, Google's 8.8.8.8, and NextDNS all support DoH.

How to Protect Yourself

Enable DNS-over-HTTPS

In Firefox: Settings > Privacy & Security > DNS over HTTPS. Enable it with Cloudflare or a custom provider.

In Chrome: Settings > Privacy and security > Security > Use secure DNS. Enable and choose a provider.

On Windows 11: Network settings now support DoH system-wide, applying to all apps, not just browsers.

Choose a Privacy-Respecting Resolver

• Cloudflare 1.1.1.1: Fast, no query logging (audited), supports DoH and DoT
• NextDNS: Configurable filtering, logging controls, family safety features
• Quad9 (9.9.9.9): Blocks known malicious domains, privacy-focused, non-profit

Avoid using your ISP's default resolver unless you trust them with your browsing history.

Secure Your Router DNS Settings

Change your home router's DNS settings to a DoH-capable resolver. This protects all devices on your network, including smart TVs and IoT devices that don't individually support DoH.

Monitor for Unexpected DNS Changes

If you suspect DNS hijacking, compare your configured DNS server against what queries are actually being resolved by. Tools like nslookup or dig can help identify discrepancies.