How DNS Works: From Domain Name to IP Address, and How DNS Cache Poisoning Works

DNS (Domain Name System) is the internet's phone book. Your browser needs an IP address to connect, but people type names like ersegment.com. The lesson above follows one lookup through every server involved, then shows how attackers poison DNS caches and how DNSSEC stops them. All IP addresses in the lesson are documentation examples.

1. The DNS lookup, step by step

Laptop → resolver: "What is the IP of ersegment.com?" (UDP port 53, with a random transaction ID.)
Resolver → root server: the root replies with a referral to the .com TLD servers.
Resolver → .com TLD server: another referral, to the domain's own authoritative name server.
Resolver → authoritative server: the official answer (AA flag set) with a TTL.
Resolver → laptop: the answer, which the resolver also caches until the TTL expires.

2. Why caching and TTL matter

The TTL (time to live) tells resolvers how long they may reuse an answer. Caching makes DNS fast: most lookups never leave your resolver. It also means one poisoned cache entry can affect every user of that resolver.

3. DNS cache poisoning (spoofing)

Classic DNS over UDP has no proof of who sent a reply. While a resolver waits for an answer, an attacker floods it with forged replies that pretend to come from the real name server, each guessing the 16-bit transaction ID. If one guess matches first, the resolver caches the attacker's IP and sends every user to a fake site. This is the idea behind the 2008 Kaminsky attack.

dns.flags.response == 1 && dns.a == 198.51.100.66

4. Defences: randomness, DNSSEC and encrypted DNS

Source port randomisation plus random transaction IDs make guessing about 65,000 times harder.
DNSSEC signs DNS records (RRSIG) with keys chained up to the root, so forged answers fail validation.
DNS over HTTPS / TLS encrypts the hop between your device and the resolver.
Never click past an HTTPS certificate warning: it is often the last line of defence against DNS spoofing.

nslookup ersegment.com
dig +trace ersegment.com
dig +dnssec example.com

Practise this in a real lab

Trace real DNS lookups with dig and Wireshark, see referrals and TTLs live, and practise DNS spoofing and its defences safely inside ER Segment's private labs.

Explore ER Segment training →

FAQ

What is the difference between a recursive resolver and an authoritative name server?

A recursive resolver does the work of finding an answer for you and caches it. An authoritative name server holds the official records for a domain and only answers for that domain.

Does DNS use TCP or UDP?

Mostly UDP port 53 for normal queries. It switches to TCP for large responses and zone transfers, and DNS over HTTPS/TLS run over TCP.

What does the AA flag mean?

Authoritative Answer: the reply comes from a server that owns the record, not from a cache.