Still experiencing DNS pollution after changing your DNS? Your local cache might not have been fully cleared!

　　When encountering DNS poisoning, many people's first reaction is to switch to a public DNS provider—such as 8.8.8.8, 1.1.1.1, or 223.5.5.5. They refresh the page full of expectation, only to find that the site still won't load or unwanted ads still appear.

　　At this point, most people begin to wonder if the new DNS server is also poisoned, leading them into a frustrating cycle of repeatedly switching DNS settings. In reality, the problem often lies in an overlooked step: the local cache hasn't been cleared. Your computer, router, or even your browser may still be holding onto the previously poisoned, incorrect resolution records. Even after switching DNS providers, the system continues to use the old cache, meaning the new DNS never gets a chance to work.

　　This article explains the hierarchy of DNS caching and the process for clearing it, helping you resolve the issue of persistent DNS poisoning despite changing settings.

　　First, let's understand where DNS cache is stored.

　　DNS resolution results are not stored in just one location. Every link in the chain—from your browser to the target server—can cache resolution records:

　　Browser cache: Chrome, Edge, and Firefox all cache DNS resolution results and have their own TTL (Time-to-Live) mechanisms. Browser cache takes precedence over operating system cache.

　　Operating system cache: Services such as the Windows DNS Client, macOS's mDNSResponder, and Linux's systemd-resolved or nscd all cache resolution results.

　　Router cache: Home routers usually feature built-in DNS forwarding and cache resolution results. If the router itself is using a poisoned DNS server, changing the DNS settings on your computer won't help.

　　ISP recursive DNS cache: Your ISP's DNS servers cache resolution results. Even if the upstream authoritative record has been updated, the ISP's cache may not yet have expired.

　　Application-level cache: Java applications, Node.js programs, and Docker containers may all maintain their own internal DNS caches.

　　The key point is this: changing your DNS settings only alters the "query path"; it does not clear the incorrect results already stored in the cache. As long as the cache remains valid, the system will not query the new DNS server at all, opting instead to return the old, incorrect result. Step 1: Verify the issue—determine which resolver is actually handling the lookup after changing the DNS.

　　Before clearing the cache, use a tool to verify the actual path the resolution is taking.

　　On Windows:

nslookup Your domain name.com

　　The output will display the currently used DNS server and the resolution results. If the displayed server address is still the old DNS (from before the change), it indicates that the system has not updated the DNS configuration; if the server address is the new DNS but the result is still an incorrect IP, it indicates that the cache has not been cleared.

　　On Linux/macOS:

dig Your domain name.com

　　Check the "SERVER" field in the output to confirm which DNS server is actually being used. Also, compare this with the result of `dig @8.8.8.8 yourdomain.com +short`. If the results differ, it indicates that your local DNS is still returning an old, cached record.

　　Criterion: If your system continues to return results different from those of a public DNS after you have switched DNS settings, the issue is likely due to caching rather than DNS poisoning.

　　Step 2: Clear browser cache

　　Browser cache is the first line of defense for DNS caching and is also the most easily overlooked.

　　Chrome/Edge:

　　Go to Settings → Privacy and security → Clear browsing data, check "Cached images and files," select "All time" for the time range, and click "Clear data."

　　However, browsers also have a hidden DNS cache that requires a specific method to clear:

　　Enter the following in the Chrome address bar:

chrome://net-internals/#dns

　　Click the "Clear host cache" button. This action specifically clears Chrome's internal DNS cache, making it more precise than clearing general browsing data.

　　Enter the following in the Edge address bar:

edge://net-internals/#dns

　　Click "Clear host cache" as well.

　　Firefox: You can view Firefox's DNS cache via the `about:networking#dns` page, but there is no direct button to clear it. The easiest methods are to restart the browser or disable the DNS cache feature (by setting `network.dnsCacheExpiration` to 0 in `about:config`).

　　Step 3: Clear the operating system's DNS cache

　　After clearing the browser cache, clear the system cache.

　　Windows

　　Open Command Prompt (run as administrator):

ipconfig /flushdns

　　The output "Successfully flushed the DNS Resolver Cache" indicates a successful flush.

　　However, Windows has another hidden cache—the NetBIOS cache. If the issue persists after running `ipconfig /flushdns`, execute the following:

nbtstat -R

　　This clears the NetBIOS name cache.

　　macOS

　　The command varies slightly depending on the macOS version:

　　macOS 10.11 and later:

sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

　　macOS 10.10：

sudo discoveryutil mdnsflushcache
sudo discoveryutil udnsflushcaches

　　After execution, the system will indicate that mDNSResponder has been restarted, signifying that the cache has been cleared.

　　Linux

　　DNS caching on Linux depends on the resolver service you are using:

　　Using systemd-resolved (default on Ubuntu 18.04+):

sudo systemd-resolve --flush-caches

　　Verify that the cache has been cleared:

sudo systemd-resolve --statistics

　　The "Current Cache Size" in the Cache section of the output should be 0.

　　Using nscd:

sudo systemctl restart nscd

　　Using dnsmasq:

sudo systemctl restart dnsmasq

　　Step 4: Clear the Router Cache

　　If you are using a home router, it also caches DNS resolution results. This step is frequently overlooked, yet it is often the culprit when changing DNS settings on your computer fails to yield results.

　　Method 1: Restart the Router

　　The simplest and most direct—yet effective—method. Unplug the power, wait 30 seconds, and plug it back in; this clears the router's cache.

　　Method 2: Log in to the Router's Admin Interface

　　The address is usually 192.168.1.1 or 192.168.0.1. Once logged in, look for options like "Clear DNS Cache" or "Restart DNS Service" under System Tools or Advanced Settings.

　　Key Action: Change the DNS server addresses in the router's admin interface to your preferred public DNS (e.g., 8.8.8.8 and 1.1.1.1). This ensures the router itself uses the new DNS rather than continuing to use the ISP's default settings.

　　Note: Some optical modems (ONUs) have built-in routing functions and cache DNS at the modem level. If restarting the router doesn't work, try restarting the optical modem.

　　Step 5: Clear Application-Level Cache

　　If the issue occurs within a specific application rather than across all internet activities, the problem may lie with that application's own DNS cache.

　　Docker Containers: DNS resolution inside a container uses Docker's embedded DNS server, which caches resolution results by default. Restarting the container clears this cache:

docker restart Network Name

　　If the container is using a custom network, you can recreate the network:

docker network disconnect Network Name Container Name
docker network connect Network Name Container Name

　　Java Application: Java's `InetAddress` class caches DNS resolution results; the default TTL is infinite (-1) unless `networkaddress.cache.ttl` is configured. Modify the `$JAVA_HOME/jre/lib/security/java.security` file and set:

networkaddress.cache.ttl=60
networkaddress.cache.negative.ttl=10

　　Node.js Applications: By default, Node.js does not cache DNS; however, if the `cache` option for `dns.lookup` or a third-party library is used, the application must be restarted to clear the cache.

　　Step 6: If the issue persists—deeper troubleshooting

　　If you have cleared the caches for your browser, operating system, router, and application, yet the DNS resolution remains poisoned despite switching DNS providers, the problem likely lies beyond local caching. Consider the following scenarios:

　　1. The new DNS is also poisoned

　　Some public DNS services can also be subject to poisoning in certain network environments. Test this by comparing results using `dig @8.8.8.8 ` and `dig @1.1.1.1 `. If multiple public DNS services return inconsistent IP addresses, the poisoning is occurring at an upstream network layer.

　　2. Static bindings in the hosts file

　　Check `C:\Windows\System32\drivers\etc\hosts` (Windows) or `/etc/hosts` (Linux/macOS) to see if the target domain's IP address is hardcoded there. The hosts file takes precedence over DNS; even if you switch DNS providers, the record in the hosts file will override the DNS lookup.

　　3. System or router tampering

　　Certain malware can modify system DNS settings or router DNS configurations. Check if your system DNS settings have been altered (e.g., reverted to the ISP's DNS) and inspect your router's administrative interface to see if the DNS configuration has been tampered with.

　　4. Using encrypted DNS (DoH/DoT)

　　If the poisoning persists, consider using encrypted DNS. DoH (DNS over HTTPS) and DoT (DNS over TLS) encrypt DNS queries, preventing intermediate nodes from tampering with them. Both Chrome and Firefox have built-in DoH support, which can be enabled in their settings. Summary of the Complete Cache Clearing Process

　　Troubleshooting steps if DNS resolution remains compromised after switching DNS providers:

　　Clear browser cache: For Chrome/Edge, use `chrome://net-internals/#dns` to clear the host cache.

　　Clear system cache: Use `ipconfig /flushdns` on Windows, `dscacheutil` + `killall` on macOS, and `systemd-resolve --flush-caches` on Linux.

　　Clear router cache: Reboot the router and update its DNS settings to a public DNS provider via the admin interface.

　　Clear application cache: Restart Docker containers, Java applications, and Node.js services.

　　Check the hosts file: Ensure no static mappings are overriding the DNS settings.

　　Verify the results: Use `nslookup` or `dig` to compare local resolution results against those from the public DNS.

　　If the issue persists: Check if the new DNS is also compromised or if the system has been tampered with; consider enabling DNS over HTTPS (DoH).

　　The core logic behind clearing the cache is that DNS resolution results are stored at multiple levels; changing the setting in just one place is insufficient. You must clear the cache layer by layer—from the browser to the system and finally the router. Often, the problem isn't that the new DNS isn't working, but rather that the old cache is still interfering. Clearing the cache thoroughly usually resolves the issue.