Yes I believe the TS was asking and mixing about DNS cache poisoning and MiTM to sniff email messages. Web Design Hero is correct. Poisoning and MiTM are two different things. Just to add up, this is my explanation of things since these are two different attack types and there are many techniques to this.
With DNS cache poisoning, there are two (2) options you can consider:
- You can choose to exploit a flaw in the DNS server to access the records OR
- You can choose to access the DNS records in a different method (using MiTM) without the need to exploit a flaw in the DNS system. What you are up to are the credentials you need to access the DNS records.
Cache poisoning works when you fill-up invalid entries to the DNS in order that subsequent DNS requests will be resolved to the malicious DNS entries once a refresh has occurred. It means if you have sample.com as your domain, and you have:
sample.com. IN MX 10 mail.sample.com.
The attacker can do:
sample.com. IN MX 10 mail.smple.com.
Upon refresh, this will be propagated to other name servers acting authoritatively whether primary or secondary etc. for your domain. The malicious host of course mail.smple.com can relay every copy of the message to the real MX mail.sample.com so everything will look okay. The detection of course is harder because obviously you do not need to check every DNS records in your name server every day not unless you will do a reconfiguration or you had something suspicious.
With MiTM, you are dealing with the network layer. The attacker needs to patch himself with the network in order to conduct the attack. It means you do not specifically need to launch an attack with the name server, you just need to associate yourself with the network to sniff. This usually works as part of the internal network, by spoofing the IP of the gateway you can start listening traffic by conducting ARP poisoning, broadcasting to the internal network that you are the legitimate gateway and forwarding the traffic to you before it reaches the other end although it can also work public IP via a BGP MiTM. It can actually defeat transport layer security like SSL/TLS not because it breaks them but because the traffic can be routed to a different port.