if attacker poisioned the cache of DNS server then it will give me illegitimate information.so, how to identify it? if the solution is to create the local database of domain name and ip addresses and compare it with DNS response then how/where to get the correct information about it?
If you can collect the DNS info beforehand set that data in a prioritized host file. If not you'd have to force queries to near random DNS servers on the Internet, ideally from a completely separate network to avoid man in the middle modification (possibly via a cell phone on a carrier network) and compare the results to what you got from the questionable DNS server.
As to how to collect safe DNS/IP info verify the Certificates via TLS/SSL if the remote systems support TLS/SSL (possibly other protocols that also use certificates).
A well configured Split DNS implementation where the Internal DNS servers don't pull from your Externally facing DNS servers will prevent external poisoning of your internal DNS resolutions.
It's a great question and an interesting design flaw that we all have to work with.
I think the important part is knowing how to implement Split DNS properly so your internal hosts don't get poisoned.
You could also tunnel all of your DNS requests to a trusted server or set of servers to avoid the man in the middle problem.
The more complicated solution is to rewrite your DNS client to poll various trusted DNS servers to compare their results with your local one to detect DNS poisoning.