According to a thread I recently read, in general, for one method of DNS poisoning, an attacker only needs to know the victim's DNS server (see this thread: DNS cache poisoning). [I'm assuming the "DNS server" referred to here is the name server ("NS" Resource Record (RR))].

This was the answer provided for the question: "What are the things the attacker needs to know from the victim to perform DNS cache poisoning?"

However, what if the following question were posed: "What would an attacker need to know about the DNS request (itself) to successfully poison a DNS cache?"

My first thought is the only information an attacker would need to know about the DNS request/query would be the address record ("A" RR).

Perhaps my issue is with a bad question/answer in the referenced thread; however, in the interest of clearing up my confusion, are there other DNS record types of the targeted site needed, in general, to conduct a successful DNS cache poisoning?

  • The post you cite does not refer to the NS record (authoritive DNS for a domain) but to the DNS server used by the client. And which records are interesting depends on the attack. But apart from A the major interesting things to spoof are AAAA (IPv6) and MX (defines server which receives mail for domain) and maybe CNAME (alias). – Steffen Ullrich Feb 15 '17 at 6:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.