DNS Pollution: Classification, Prevention, and Resolution—A Comprehensive Defense Guide, from Link Hijacking to Cache Poisoning

By 2026,DNS pollution was no longer a"niche technical glitch."Investigations disclosed by the National Computer Network Emergency Response Technical Team/Coordination Center of China(CNCERT/CC)revealed that an overseas autonomous system(AS 402425)had hijacked traffic—redirecting it into its own network via fraudulent route announcements—and subsequently tampered with DNS resolution values.This affected ordinary users across multiple provinces.In July of the same year,a large number of mobile broadband users in Yunnan,Guizhou,Sichuan,and other regions experienced automatic browser redirects to inappropriate websites;the issue persisted for nearly two months,with over 500,000 domain names suffering from resolution anomalies.Even more concerning was an incident in May 2026 involving Bilibili(Bilibili.com),where DoT(DNS-over-TLS)connections used by China Telecom subscribers were hijacked—demonstrating that even encrypted DNS can be rendered ineffective when interference occurs at the carrier/ISP level.

Understanding the classification of DNS pollution is a prerequisite for building effective defenses.Different types of pollution—occurring at various stages—have distinct causes,manifestations,and mitigation strategies.

Classification by attack surface:Where in the resolution chain does the pollution occur?

DNS resolution is a multi-stage chain:User Device→Local Recursive DNS→Authoritative DNS.Defense strategies vary significantly depending on where in this chain the pollution takes place.

"Man-in-the-middle"(MITM)pollution occurs during transmission between the user device and the recursive DNS server.An attacker(or an intermediary device)monitors the query path—typically on UDP port 53—and,upon detecting a request for a specific domain,immediately injects a forged response.Because the DNS protocol operates on a"first-come,first-served"basis,the user device accepts the first response it receives;any subsequent,legitimate response is simply ignored.A hallmark of this type of pollution is that switching to an encrypted DNS protocol(such as DoH or DoT)often resolves the issue,as the query content is encapsulated within an encrypted tunnel,preventing intermediary devices from identifying or tampering with it.

Recursive DNS cache poisoning occurs at the level of the recursive server.An attacker injects fraudulent resolution records into an ISP’s or a public recursive DNS server,causing it to cache incorrect IP addresses.Consequently,any user querying that server will receive the erroneous result for the duration of the record's TTL(Time-to-Live).The scope of such pollution is directly proportional to the number of users served by the affected recursive server—if a recursive node belonging to a provincial-level ISP is poisoned,a vast number of users across that entire province are affected simultaneously.The"REBIRTHDAY"attack,disclosed at Black Hat Asia in June 2026,exploits implementation flaws in the EDNS Client Subnet(ECS)extension.By bypassing traditional security mechanisms—such as randomized source ports and query IDs—this attack enables cache poisoning against major global DNS resolver software;18 out of 22 widely used DNS software packages are affected.

"Authoritative-side"poisoning is the most thorough form of DNS manipulation,though it is relatively rare.In this scenario,attackers gain control over—or tamper with—DNS records at the domain registrar or the authoritative DNS server.Consequently,regardless of how"clean"or secure a user’s recursive DNS resolver may be,the"official"response they receive has already been compromised.Defense in this context shifts away from link-layer encryption toward securing registrar accounts(e.g.,through multi-factor authentication and domain locking)and strengthening the intrusion resistance of the authoritative DNS infrastructure itself.

Categorization by Actor:Strategic Poisoning vs.Malicious Attacks

"Strategic poisoning"is carried out by national or regional firewalls at critical network nodes,returning incorrect IP addresses for specific domains.This type of poisoning is geographically targeted and focused on specific domains—often linked to content compliance regulations within a given country or region.Because such measures are difficult to counter with a single technical fix,maintaining service availability often requires a combination of encrypted DNS,alternative domain names,and traffic diversion.

"Malicious"DNS poisoning is driven by financial gain or an intent to cause disruption.Rather than targeting specific domains,these attacks exploit protocol vulnerabilities to perform indiscriminate cache poisoning.A notable trend as of 2026 involves combining BGP route hijacking with DNS tampering:attackers use anomalous BGP announcements to reroute traffic through their own infrastructure,where they then alter DNS responses in transit.Because the user’s connection appears as a legitimate,HTTPS-encrypted session—with no security warnings triggered in the browser—it is often difficult for organizations to immediately identify that the root cause of the issue lies at the routing layer.

Detection:Cross-Verification via`dig`(Rather than Relying on`ping`)

The`ping`command relies on the system’s current DNS configuration.If the local DNS resolver has already been poisoned,`ping`will return an incorrect IP address,rendering it an unreliable diagnostic tool.The correct approach is to perform cross-verification by comparing the resolution results obtained from multiple,independent DNS servers.#DNS resolution result from the default local DNS(suspected sample)

dig yourdomain.com+short

#Queries to trusted public DNS resolvers

dig@8.8.8.8 yourdomain.com+short

dig@1.1.1.1 yourdomain.com+short

dig@223.5.5.5 yourdomain.com+short

If the IP address returned by the default local DNS differs significantly from the results provided by multiple public DNS resolvers—and exhibits one or more of the following characteristics—it is highly likely that DNS poisoning has occurred:the returned IP is`127.0.0.1`or a private(internal)network address;the returned IP is unreachable via`ping`;or the TTL(Time-to-Live)value is abnormally short(standard records typically have a TTL of 300 seconds or more,whereas poisoned responses may have a TTL of only a few seconds or even a randomly fluctuating value).

To further pinpoint where the poisoning occurs,use`dig+trace yourdomain.com`to trace the resolution process step-by-step,starting from the root servers.If the authoritative nameserver returns the correct IP,but the result changes abruptly at a subsequent hop,the poisoning is taking place during the intermediate forwarding stage—not within your own DNS configuration.

Layered Defense:No"Silver Bullet,"Only Defense-in-Depth

There is no single,definitive solution to prevent DNS poisoning.As of 2026,the reality is as follows:Encrypted DNS can thwart"man-in-the-middle"attacks on the network path,but it is ineffective against cache poisoning at the recursive resolver level or tampering at the authoritative source.DNSSEC can verify the integrity of resolution results,but its effectiveness depends on the widespread adoption of validating resolvers,and it is not a panacea against interference imposed at the ISP(Internet Service Provider)level.A pragmatic approach involves a layered,defense-in-depth strategy.

Layer 1:Encrypted DNS(DoH/DoT)—Eliminating the conditions for on-path tampering.By encapsulating DNS queries within HTTPS or TLS tunnels,intermediate network devices are unable to inspect the query content,thereby preventing them from forging responses.Empirical data shows that enabling DoH can reduce the rate of erroneous DNS resolutions from an average of 12.7%to less than 0.3%.Implementing encrypted DNS at the browser,operating system,or router level is the most cost-effective and immediate measure one can take.

Layer 2:DNSSEC—Ensuring the authenticity of resolution results.DNSSEC uses digital signatures to enable recursive resolvers to verify that a response originated from an authoritative server and has not been tampered with during transit.For domain names that are signed and possess a complete chain of trust,any forged response—even if it reaches the resolver—will be rejected due to a signature verification failure.In its SP 800-81 Rev.3(updated in 2026),NIST further recommends the use of more modern signature algorithms,such as ECDSA and Ed25519/Ed448.It is important to note,however,that while DNSSEC protects against"tampering,"it does not address"visibility"or DDoS attacks;its effectiveness ultimately depends on whether the recursive resolver actually performs the verification.

Layer 3:Anycast-based distributed resolution and high-capacity traffic scrubbing enhance the resilience of the network path.Authoritative DNS services deployed on a single node or a limited number of nodes are more vulnerable to targeted interception and attacks.An Anycast architecture routes resolution requests to the nearest available node;consequently,any localized network contamination or attack is confined to a very small scope,allowing other nodes to continue functioning normally.Furthermore,the traffic-scrubbing capabilities of a high-security DNS service can defend against DDoS attacks aimed at the DNS infrastructure itself,preventing a scenario where the resolution service is knocked offline while simultaneously having its results tampered with.

Layer 4:Backup domain names and traffic diversion serve as a safeguard for worst-case scenarios.If a primary domain name suffers from severe contamination in a specific region—and the aforementioned measures fail to restore service in the short term—directing users to a backup domain via non-web channels(such as mobile apps or email)is a pragmatic,baseline strategy to maintain business continuity.This is not an"admission of defeat,"but rather a way to keep user churn within an acceptable range while an attack is ongoing.

From"Reactive Firefighting"to"Continuous Visibility"

The tricky aspect of DNS contamination is that it is often discovered only after user reports,by which point the attack may have already persisted for hours or even days.Establishing continuous monitoring of resolution status—using probe nodes across various geographic regions and network operators to regularly compare actual resolution results against an authoritative baseline—is the only way to transform"post-incident discovery"into"proactive interception."