DNSSEC: Build a Chain of Trust to Stop DNS Attacks

Imagine you type the URL of your bank into the browser and get a login page. After you enter credentials, you get a notification from your service that a new login has been registered. You ignore it and soon find your bank account emptied by unknown actors. What happened? The IP address behind that bank domain name has been silently changed to one controlled by an attacker.

The attack is called DNS spoofing or DNS cache poisoning. In this scenario, the attacker causes the bank’s domain name to resolve to a malicious IP address. This directs users’ requests to a fake server. It can be difficult to notice: the address bar still shows the correct website name and fake sites look real.

Not a member? Read this article in my Tech Notes.

Even more, if the attacker runs a reverse‑proxy, the user receives the genuine webpage keeping the original domain name in the address bar. The user sees a perfectly normal page that makes it impossible for them to understand that someone is already stealing their data. This dangerous type of attacks is called DNS‑based Man‑in‑the‑Middle (MITM).

How to stay safe

There is no direct foolproof method to detect DNS spoofing from the user’s side. They must rely on indirect safeguards, like checking a website’s SSL…