Quick Summary
DNS spoofing changes the answer to the lookup question. Instead of getting the real IP address for a domain, the victim receives a malicious or incorrect result.
Technical explanation
Spoofing can happen in several ways: compromised routers, rogue hotspot networks, malicious software, or poisoned recursive caches. The common pattern is the same: the user thinks they are going to one destination, but DNS points them somewhere else.
Real-world examples
- A fake banking page delivered after a manipulated DNS response.
- Malware that changes the router DNS settings to a hostile resolver.
- Captive portals or filtering systems that rewrite answers and make a domain appear blocked.
Unexpected resolution results do not always mean an attack. Sometimes a blocked or failing resolver is the cause. For diagnosis, read how to check if DNS is blocked and what DNS failure means.
