Are there any things which the user can do, on their own machine, to protect against DNS spoofing? I was just thinking when I was at the airport last and I wanted to check my email I used a hotspot access point, paid for the access using my paypal and that could probably have been intercepted. What could I have done from my end to maximize my protection?

I would usually suggest vpn, or ssl but this isn't something the user can decide, thats something for the network owner to implement?

2 Answers 2


Technically that could have been an ARP cache poisoning attack which is much more likely to occur. I'd suggest using SSL (Secure Socket Layers) and TLS (Transport Layer Security) as well as only connecting to the sites with "HTTPS://" addresses to encrypt your connection. Using a proxy or VPN protects your IP address from users on the other side of the modem, but not people within the network you're using.

  • The things you suggested, what are they to prevent? ARP or DNS? Am I right in that they couldnt choose VPN because the network admin would have to set this up?
    – Paul
    Dec 24, 2011 at 18:20
  • @Jason I don't think you know what DNS, ARP, TLS, SSL and MITM means.
    – rook
    Dec 24, 2011 at 18:26
  • 1
    I agree with Rook, and a DNS is a domain name server, they are very secure and what they do is route traffic, say you type "google.com" into your web browser, you would connect to a DNS server and be routed to google's IP address. The things I suggested don't prevent anything from happening, they just make sure your data is encrypted in the transfer so that anyone who happens to be listening will get a garbled mess. Now, some people might be able to decrypt the garbled mess, but it will deter most crackers from stealing your data.
    – zenware
    Dec 24, 2011 at 18:32
  • Deleted unnecessary language
    – Paul
    Dec 24, 2011 at 18:39
  • @Rook, Im not talking about cache poisoning, im talking about DNS spoofing. How's that for my terminology?
    – Paul
    Dec 24, 2011 at 18:41

To use a VPN you would of had to of obtained access to a VPN service, either by running one on a server or vm of your own somewhere, or (eaiser!) by subscribing to a commercial VPN providers service.

That won't help you if the network you are connecting to blocks the VPN technology you are planning on using.

Using a VPN is a good idea especially if you use unencrypted WIFI that way you are protected against random people snooping the radio traffic as well as rogue network operators.

You don't need the network owner to do anything to let you use a VPN.

If your VPN provider is malicious or compromised then using the VPN would make no difference.

If you are verifying SSL certificates on the sites you browse to (which your browser will be), and the sites don't mix non SSL and SSL content (which they shouldn't, and some browsers block mixed content nowadays as a security measure) then if DNS is spoofed the bad guys doing the spoofing won't be able to present a valid certificate for the domain so you'll get a browser warning.

For some sites the bad guys may be able to force a protocol downgrade so you don't get SSL.

There is a firefox add on - https everywhere from the EFF: https://www.eff.org/https-everywhere that tries to force as many sites as possible to https. Using it is an improvement over the current state of afairs.

It's also worth having a look at Certificate Patrol and Prespectives for other Firefox addon goodness.

You could run a local DNS resolver and enable dnssec validation on it. However it won't protect you against domains that arn't dnssec signed being spoofed, and in anycase networks that snoop on dns queries and mangle them may just drop dns packets that are dnssec signed breaking the net for you entirely.

Of course if your supper paranoid that's just a good reason to not use that network.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .