How DNS Works and Its Risks

The Domain Name System (DNS) translates human-friendly names like example.com into IP addresses such as 93.184.216.34. Almost every network transaction starts with a DNS lookup, which makes DNS a high-value target.

If an attacker controls or manipulates name resolution, they can silently redirect victims to malicious servers, intercept traffic, or exfiltrate data without touching the application itself. Understanding the resolution path is the first step to defending it.

A typical recursive lookup walks a chain of servers:

• Stub resolver on the client (the OS).
• Recursive resolver (your ISP or 8.8.8.8) that does the legwork.
• Root servers that point to the TLD servers.
• TLD servers (e.g. .com) that point to authoritative servers.
• Authoritative servers that hold the real records.

Each hop is a potential interception or spoofing point.

A recursive resolver answers any query by chasing referrals on the client behalf and caching the result. An authoritative server answers only for the zones it owns, with the definitive data.

Security-wise: open recursive resolvers can be abused for amplification attacks, while authoritative servers are targets for zone hijacking and registrar compromise. Keep recursion closed to your own network.

Records you will meet during analysis:

• A / AAAA — IPv4 / IPv6 address.
• CNAME — alias to another name (watch for dangling CNAMEs leading to subdomain takeover).
• MX — mail servers.
• NS — delegation to authoritative servers.
• TXT — free text, used for SPF, DKIM, and often abused for tunneling.

Classic DNS runs over UDP port 53, with a fallback to TCP 53 for large responses and zone transfers. UDP is connectionless and stateless, so there is no handshake to prove the responder is who it claims to be.

The only correlation between a query and its answer is a 16-bit transaction ID and the source port. This weak binding is the root cause of spoofing and cache poisoning.

To reduce load, resolvers cache answers for the duration of the record TTL (time to live). A response with TTL 3600 stays cached for one hour.

Caching is a double-edged sword: it improves performance but means a single poisoned answer can serve many victims until the TTL expires. Attackers often try to push long TTLs to make malicious entries persist.

DNS exposes many surfaces:

• On-path spoofing — forging responses faster than the legitimate server.
• Cache poisoning — injecting bad records into a resolver cache.
• Registrar / zone hijack — stealing control of the domain itself.
• Tunneling — encoding data inside queries to bypass egress controls.
• DDoS amplification — abusing open resolvers as reflectors.

Plain DNS provides no integrity or authenticity guarantee. A response is trusted if it matches the source IP, destination port, query name, and transaction ID. All of these can be guessed or observed by an on-path attacker.

This design assumption (the network is trustworthy) is why bolt-on protections like DNSSEC, DNS over TLS (DoT), and DNS over HTTPS (DoH) exist.

Before attacking, adversaries enumerate DNS to map your estate. Misconfigured zone transfers (AXFR) can dump every record. Subdomain brute-forcing and certificate transparency logs reveal hidden hosts.

Defenders should restrict zone transfers to known secondaries and monitor for bulk query patterns that signal enumeration.

DNS over TLS (port 853) and DNS over HTTPS (port 443) encrypt the query so on-path observers cannot read or tamper with it. This blunts spoofing and protects privacy.

The trade-off for defenders: encrypted DNS can blind your own filtering and monitoring. Many enterprises pin clients to a controlled DoH/DoT resolver rather than letting endpoints choose external ones.

Practical hardening for the resolution path:

• Run internal recursive resolvers; block direct outbound port 53 to the internet.
• Disable open recursion on authoritative servers.
• Restrict and log AXFR zone transfers.
• Lock the domain at the registrar (registry lock, MFA).
• Monitor query volume and entropy for tunneling and enumeration.

Test your understanding of why DNS is exposed.

You learned that DNS resolution walks a chain from stub resolver through root, TLD, and authoritative servers, and that answers are cached by TTL. Because classic DNS over UDP/53 lacks authentication, it is exposed to spoofing, cache poisoning, hijacking, tunneling, and amplification.

Key defenses: closed recursion, restricted zone transfers, registrar locks, encrypted transport (DoT/DoH), and DNSSEC. Next, we dig into spoofing and cache poisoning in detail.