What are the symptoms of a website being DNS poisoned? Judge by these 5 signs!

　　When you enter a familiar website address, but your browser tells you "This website cannot be accessed," it's often not because the server is down or your broadband is overdue, but because your website is suffering from DNS poisoning.

　　DNS poisoning can be roughly understood as "domain name resolution being swapped." Unlike a server failure that directly "goes on strike," it directs you down a "wrong path," preventing you from finding the correct destination. Many website owners, when encountering this problem, first suspect the server, only to discover after much troubleshooting that the problem lies in the DNS.

　　Symptom 1: The same website, two completely different experiences in different regions

　　This is the most typical and easily detected characteristic of DNS poisoning. DNS poisoning is usually not global, but rather exhibits significant regional and random characteristics.

　　Specific manifestations: Your website can be accessed normally in Beijing, but displays "Domain not found" or "Unable to connect" in Guangzhou; or access is normal within China, but overseas users cannot access it at all.

　　Why does this happen? DNS poisoning often occurs on specific network nodes or recursive servers, rather than the root servers. Therefore, it presents a strange state of "partial regional corruption," which is the core difference between it and a server outage (usually manifested as a global inaccessibility).

　　How to verify: Use an online DNS testing tool (such as DAIN's Global DNS Test), enter your domain name, and view the resolution results from multiple nodes worldwide. If most nodes resolve normally, and only a few regions return incorrect IP addresses, then it can be basically confirmed that DNS poisoning exists in that area.

　　Symptom 2: Able to ping the IP address, but the domain name remains inaccessible.

　　This is another very misleading symptom. When you execute the ping command on the website domain name, you find that it returns an IP address, but this address is not your server's IP address, and may even be a completely unreachable and invalid address.

　　Key point: The ping command returned a result, indicating that the DNS resolution itself was "successful" (because the domain name was indeed translated into an IP address), but the result is incorrect. This is the essence of DNS poisoning: returning a fake, but seemingly valid, resolution result, leaving you with no way to resolve the issue.

　　Verification Method:

　　First, check the returned IP address locally using the `nslookup` or `ping` command.

　　Then, use a public DNS (such as Google's 8.8.8.8 or the domestic 114.114.114.114) and query again using the command `dig @8.8.8.8 yourdomain.com`.

　　Compare the two results. If 8.8.8.8 returns your server's real IP, while your local default DNS returns an unfamiliar, garbled IP, then congratulations, you've been infected.

　　Note: Many websites use CDN services. The IP obtained by pinging is not your origin server's IP, but the CDN node's IP. In this case, you cannot determine pollution based solely on whether an IP matches; you need to use more precise tools like `dig` for a comprehensive assessment.

　　Symptom 3: Frequent redirects to unfamiliar pages, or even phishing websites, during access.

　　This is one of the dangerous consequences of DNS poisoning. If you or your users visit a website and, without triggering any clicks or redirects, the URL address bar redirects uncontrollably to advertising pages, pornographic websites, or even fake bank login pages, this is very likely "hijacking" caused by DNS poisoning.

　　Principle: Poisoned DNS resolves your domain name to a malicious server controlled by the attacker. Upon receiving the request, this server directly returns a page with a 302 redirect response, directing the user to a pre-set trap website.

　　Risk: This symptom not only affects user experience but can also lead to the leakage of user information. When users are redirected to fake bank or payment pages and enter sensitive information, they face the risk of financial loss.

　　Symptom 4: Frequent Changes in DNS Resolution Results

　　Normally, a domain's DNS resolution records (A records) are relatively stable and do not change frequently in a short period. If you repeatedly query the same domain using tools like `dig` or `nslookup` and find that the returned IP addresses are different each time, and these IPs are unrelated to your real server, this is also a strong sign of DNS poisoning.

　　Cause: This instability could be due to dynamically generated forged responses by attackers, or it could be caused by a corrupted configuration or caching error at the source of the pollution (such as a hacked recursive server). In either case, it indicates that the DNS resolution chain for this domain has "gone mad" and is no longer trustworthy.

　　Symptom 5: Access Returns Normal After Switching Networks on the Same Device

　　This symptom closely resembles the daily experience of ordinary users and is an important basis for diagnosing DNS poisoning.

　　Scenario Reproduction: You cannot access your website using your phone connected to your home Wi-Fi, but when you turn off Wi-Fi and switch to mobile 4G/5G, the website opens instantly. Or, you cannot access it on your work computer, but you can using your mobile hotspot.

　　Conclusion: This directly indicates that the problem lies in your current network environment (i.e., the DNS service of the Wi-Fi or company network), not the website server itself or your computer. Your Internet Service Provider's (ISP) DNS server may be experiencing resolution errors or being poisoned.

　　FAQs：

　　Q1: Are DNS poisoning and DNS hijacking the same thing?

　　A1: Not entirely the same, but they are often used interchangeably. Simply put, hijacking is a problem with the "person" (a hacker takes control of the server and deliberately diverts traffic), while poisoning is a problem with the "path" (data is tampered with during transmission, and you receive the wrong address). In terms of results, hijacking often manifests as "accessible but with incorrect content," while poisoning tends to result in "completely inaccessible or inconsistent results across different regions."

　　Q2: The server is working normally, but users in some regions report being unable to access it. Is it poisoned?

　　A2: Very likely. This is one of the most common manifestations of DNS poisoning. Poisoning is usually not global but rather regional and random. It is recommended to immediately verify using a global multi-node DNS detection tool.

　　Q3: How can I troubleshoot DNS poisoning myself using a simple command?

　　A3: The `dig` command is recommended. To analyze DNS pollution, execute `dig @8.8.8.8 yourdomain.com` to compare the results with the public DNS, or execute `dig +trace yourdomain.com` to trace the complete DNS resolution path. If an incorrect IP address is returned at some intermediate node, you can pinpoint the location of the pollution.

　　Q4: What can a website owner do after discovering DNS pollution?

　　A4: Several strategies can be adopted. The most direct is to replace the public DNS server; an advanced solution is to configure encrypted DNS such as DNS over HTTPS (DoH); if the domain supports it, enabling DNSSEC can also effectively prevent DNS record tampering.

　　DNS pollution is like a lurking "road sign vandal." It doesn't directly attack your server, but rather disorients users while they search for their way. When your website exhibits these five symptoms—regional access anomalies, resolving to fake IPs, inexplicable redirects, and fluctuating DNS resolution results—don't blindly fix the server; first, check if the "path" is correct. Understanding these symptoms will help you find the right direction more quickly when dealing with website access problems, rather than being misled by the superficial signs of pollution.