Secure DNS: DNSSEC and DNS over HTTPS (DoH)
Learn how DNSSEC prevents DNS cache poisoning and how DNS over HTTPS and DNS over TLS protect query privacy against on-path observers.
DNS Security Challenges
The Domain Name System (DNS) translates human-readable domain names into IP addresses. Designed in the 1980s, DNS was built without security — queries and responses travel over UDP/TCP port 53 in plaintext with no authentication. This creates two major vulnerabilities: DNS cache poisoning (injecting forged DNS responses to redirect users to malicious servers) and DNS eavesdropping (observing which domains a user queries reveals their browsing activity). Two standards address these: DNSSEC prevents forgery, and DNS over HTTPS (DoH) prevents eavesdropping.
DNS Cache Poisoning
DNS cache poisoning (Kaminsky attack) exploits the DNS protocol's lack of authentication. A resolver sends a query to an authoritative DNS server and caches the response for the TTL duration. An attacker who can guess the transaction ID (16-bit, predictable) and source port (used as additional entropy since RFC 5452) can send forged responses that the resolver caches, redirecting all users who query that resolver to the attacker's server. Once the cache is poisoned, users are directed to fake servers even though they typed the correct domain. DNSSEC prevents this by digitally signing DNS responses.
# DNS cache poisoning simulation
# Attacker floods resolver with forged responses
# for the query 'A example.com?'
# Each response guesses a different transaction ID:
# ID=1234: example.com -> 198.51.100.1 (attacker IP)
# ID=1235: example.com -> 198.51.100.1
# ...
# ID=XXXX: example.com -> 198.51.100.1 (correct guess!)
# Resolver caches poisoned answer (TTL = 3600s)
# All users querying this resolver get attacker IP
# Users are redirected to phishing/malware serverAll lessons in this course
- Replacing Insecure Protocols: Telnet vs SSH, FTP vs SFTP
- TLS Versions, Cipher Suites, and Perfect Forward Secrecy
- Secure DNS: DNSSEC and DNS over HTTPS (DoH)
- IPsec, VPN Protocols, and Remote Access Security